Overview

overview

7

Static

static

3

2026-08-20...op.exe

windows10-2004-x64

7

2026-08-20...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 02:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
  • Size 4.7MB
  • Sample260821-clbzcs1blc
  • SHA256 7171dad6d0bd107c85729029c56053612b44e36690885e07c30fd7f97e40da9b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF24A.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF74C.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3700
          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5176
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF96E.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1924
              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3332
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBDF.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4052
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:5336
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEDD.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3448
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:260
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4564
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:5356
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a323.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4336
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2284
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a584.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3024
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4968
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a863.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3184
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:620
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a118A.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2148
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:3540
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13CC.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:4180
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:2064
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a161E.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5856
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4868
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AA2.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2180
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2164
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C75.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:444
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3576
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E59.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1916
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4924
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33F7.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3056
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4956
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a358D.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4104
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2532
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37EE.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3232
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1192
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39E2.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5096
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5344
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CFF.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2040
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4936
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4685.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4576
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1292
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a484A.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2108
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5280
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4954.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:6080
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:784
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A1F.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2868
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5636
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AF9.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3572
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3352
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BD4.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1628
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4628
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CAF.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:832
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4976
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D99.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2948
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1032
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E55.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4788
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1384
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F6E.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2972
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4484
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5049.bat
                                                                                                                              62⤵
                                                                                                                                PID:2624
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:4548
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5114.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:2044
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:5304
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51FE.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:4876
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:3096
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52F8.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:1080
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:4928
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53D3.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1140
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:1792
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54AE.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:4304
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:1136
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5589.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2664
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:5532
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5663.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:1396
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:1340
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a574E.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:3932
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:2828
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5819.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:3416
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4816
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5922.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:2388
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:5360
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A0D.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:5772
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:1936
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B07.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                        PID:5440
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:4376
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C01.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:4192
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:2848
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CFB.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:3452
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:4428
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E14.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4736
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:5412
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F0E.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:3412
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:5720
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FF8.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:5076
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4680
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60B4.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:2184
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:3404
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a618F.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:3648
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1676
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6269.bat
                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                          PID:5420
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2372
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6354.bat
                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                PID:2988
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:2504
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a645D.bat
                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:1548
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:3176
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6538.bat
                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                          PID:2352
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:5628
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6632.bat
                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:4444
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:3112
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a673C.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:5444
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:4656
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6826.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:3844
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:4472
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68F1.bat
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                            PID:5964
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:2248
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69BC.bat
                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                  PID:5556
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:3508
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AB6.bat
                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                        PID:4752
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:4056
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B82.bat
                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:5992
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:4412
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C6C.bat
                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:2932
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:2156
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D27.bat
                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                      PID:5476
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:1216
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E21.bat
                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                            PID:4732
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                PID:6016
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F1B.bat
                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:5896
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                      PID:1180
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7015.bat
                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                          PID:4256
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                              PID:4352
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7100.bat
                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:4384
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                    PID:2652
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71EA.bat
                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                        PID:5904
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                            PID:5980
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72F4.bat
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                PID:4380
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:5296
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73BF.bat
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:964
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                        PID:4128
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74B9.bat
                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:4296
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:5908
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7594.bat
                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                PID:2000
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:6076
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a767E.bat
                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2852
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2152
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7768.bat
                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4808
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:4404
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7872.bat
                                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:1996
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5196
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a796C.bat
                                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:4820
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2788
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A76.bat
                                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:4280
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:8
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BAE.bat
                                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:412
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1732
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CA8.bat
                                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4188
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:1560
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DA2.bat
                                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:944
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F87.bat
                                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8090.bat
                                                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a819A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8294.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a835F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8469.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:972
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8534.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2032
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a864D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8737.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8870.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C77.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DCF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F36.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a905F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9169.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9418.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a964B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A04.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B4C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C36.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DBD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EB7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FB1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA37A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA474.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA56E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA629.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA704.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA89A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA994.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC34.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADDA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFCE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB099.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB174.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB26E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB349.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB404.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB56B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5152
                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                            2⤵
                                                                                                                                                            • Creates a file in the Startup directory
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:4156
                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                              3⤵
                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                              PID:3396
                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:1232

                                                                                                                                                          Network

                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                Replay Monitor

                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                Downloads

                                                                                                                                                                $$a118A.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a118A.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 2d27d89d9fae182e376366e5eb8c768f2e80e70b560d58a9c228426ada920975
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a13CC.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a13CC.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 35a22c7b07d6e1d651b4d37e80a20ed3b0ade811891352c07f1bb85417a4cde8
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a161E.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a161E.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 1a4b3e168d73c778b71698653c04a24d5ccc0c409d04709126b6f66db42ff422
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a1AA2.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1AA2.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 d6ff6e2fbadc3eed257189e8bc9e62ed8b5b79ba2538edc1a17f5416da7f6f9d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a2C75.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a2C75.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 4d1fe8b321076fed442d6be1d52c56acaf782bd790971324a7a7b0dd6cfc16e4
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a2E59.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a2E59.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 72d917f42913a84b956872e1866addd39e0a37f2fea9f19de0e84e665e1ec9c6
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a323.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a323.bat
                                                                                                                                                                • Size 775B
                                                                                                                                                                • SHA256 8c5d26f2dcc2a1da0ed0fea1b073698bd2bac3e481c7a35cb99f8d6a5da20233
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a33F7.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a33F7.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 be18bb70a9e31d2db7f7844162747cbccbff9d2f5f374bf6ff19f6483a9b49b3
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a358D.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a358D.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 f1fb92b6e3becca5ed9a9305e3ae9f98dde8b54c386cc0a22593e8e71f12a87c
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a37EE.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a37EE.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 38a62287aa6cf26ebd93eca0427794f5824db69c40e3ebdfabc10b256b6ecaf6
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a39E2.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a39E2.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 aa0ec5924827a242c00d893f8ddc93f64b1541099e8009b1493533a038e7a6ae
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a3CFF.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3CFF.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 2d629ccc1589c4cb08c73592e89432a3ae28c5cf51d1c5867091b71587e87d5d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a4685.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4685.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 c3266c8b0a9f8320140dd9509b3bdb5b464c2e3072ae812edd4f675d9247c36d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a584.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a584.bat
                                                                                                                                                                • Size 775B
                                                                                                                                                                • SHA256 dedf8521ad2db916f216ba9a0e5327a7a7053aedf44252f838d67e57deb36f93
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$a863.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a863.bat
                                                                                                                                                                • Size 775B
                                                                                                                                                                • SHA256 3b97e59453650e14aa6a425942786d279c3a6ddbecf7822dfc2f8971d7283c43
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$aB2.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB2.bat
                                                                                                                                                                • Size 774B
                                                                                                                                                                • SHA256 edbcf205e58653375c5d3438d5ad59e36795e8e9f1d56b7a481936b598f51b8b
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$aF24A.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF24A.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 e733722958392cf0c82d715a97d207098e13f19e81054465578861c263b77db0
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$aF74C.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF74C.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 b8605d0058122dd2e01fea042710fc2a3d90145b4ae15c4495653b87ddca7ca0
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$aF96E.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF96E.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 0a5cf8560d13e96ca13e905251d9feb4450c3fb127ae8b65f50a766015f5a108
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$aFBDF.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aFBDF.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 07288d78a88157e70ec553237a9b5a2bea46c51798626f0e4c34a16c24aae8a0
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                $$aFEDD.bat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aFEDD.bat
                                                                                                                                                                • Size 776B
                                                                                                                                                                • SHA256 2027147c112480bc62012fd253237edadae39021538c79b80c6b9282b2b9001d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.3MB
                                                                                                                                                                • SHA256 f6fdb2859649ef40e7c7932aa550764b46ecd9b9a7e3726660acc4e766bb3b46
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.2MB
                                                                                                                                                                • SHA256 f4cff36f5df57718d99a885b899c9bf57f1bd1d99b210cdf42b7e870137eb9f7
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.1MB
                                                                                                                                                                • SHA256 1db1ac0cb339af41acc553eba4a47606b613c7b2efc63681acc39e0f04ab0688
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.2MB
                                                                                                                                                                • SHA256 05e0c78e6aedc6f9987e92d9fed5c3c30fa8f34b31b7b230a9e78bda8196098a
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.3MB
                                                                                                                                                                • SHA256 1bbdaee556454d5362896b2a69112c159cb07cc0aba67af5b3203bce0f8b1eb4
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.2MB
                                                                                                                                                                • SHA256 1260fd3394327ec666195a35d220d08b308b01792b32d5e6e556bae4a345f08a
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.4MB
                                                                                                                                                                • SHA256 10c20b3e4e67160eb794e82e7b7f504e0c27513b366efd321b7b0e8a0938e079
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.2MB
                                                                                                                                                                • SHA256 b1743d3560584496dc307a4556991af62c080c86083b751d6484477300516671
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.3MB
                                                                                                                                                                • SHA256 45d82ba039e5da211fd08d6798981209db9189b3e468e0981b4b4cd9e9d0232b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.1MB
                                                                                                                                                                • SHA256 68381ff0485ebf6831ef6ad5efbc78583d54bfb9c6c3d1358189bb522d80ba47
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.6MB
                                                                                                                                                                • SHA256 151198f38cfa786de88a7df3404f1e543cc11dc3f22666e79a05852582f97920
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.4MB
                                                                                                                                                                • SHA256 79b1a1f9d969634bacaf67968f53072e14d43bd6942e1cbd157f502ee645a603
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.6MB
                                                                                                                                                                • SHA256 c20cabbeca8d4ede8f23e8467fdb7638e864f5246b454aad16254b2f1e2b9afb
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.5MB
                                                                                                                                                                • SHA256 201f50912553159ab3bbea78e4846b8ed1d082e9aee5f590d0d717fb13b4a539
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.4MB
                                                                                                                                                                • SHA256 be620700e41595d22510b7a023451df0610bb7c83ca2336dcec19d266ee4e0f9
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.7MB
                                                                                                                                                                • SHA256 6316396d921d28833e33bee5569b3f48ff843457985bc9ba2c1028f341f90e92
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.7MB
                                                                                                                                                                • SHA256 678e61f8e73e9f7f771c26ad9966b7f7bf4d9081f508a1a6f5952c912d45bdc6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.6MB
                                                                                                                                                                • SHA256 97d1435b04d85e877077524ff4c88d139362aab15324a74f7626fa7aaa35133d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.5MB
                                                                                                                                                                • SHA256 de5ddc46e99c814265c6da294f294233d5f5020e89f7a92d4ff8c7c511009ebb
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_f7df9505295de4037a4c10cc349503d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                • Size 4.5MB
                                                                                                                                                                • SHA256 8ddaa317c3987ecb0c026961bed528e24b2d7dcb8f4a65d319df15319d99a900
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Logo1_.exe
                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                • Size 32KB
                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                _desktop.ini
                                                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-552508041-2681165170-3229858294-1000\_desktop.ini
                                                                                                                                                                • Size 9B
                                                                                                                                                                • SHA256 ca5e7f714b31222d3a0456628bf2a133dfb526963a189811203e07b2c94176a3
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                memory/8-8396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/260-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/620-1725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/628-8523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/784-8108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/852-8685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/944-8414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/972-8456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1016-8541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1032-8133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1036-8474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1048-8498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1064-25-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1136-8173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1180-8324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1192-6098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1216-8312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1292-8096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1340-8183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1384-8138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1408-8643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1412-8721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1428-8432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1560-8408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1676-8243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1732-8402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1792-8168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1864-8450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1936-8203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2032-8462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2064-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2116-8595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2152-8372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2156-8306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2164-5593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2168-8486-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2248-8285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2272-8607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2284-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2332-8631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2372-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2456-8577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2504-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2516-8547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2532-6086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2540-8505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2604-8589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2652-8336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2788-8390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2820-8553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2828-8188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2848-8213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2876-8517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2936-8691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3096-8158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3112-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3176-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3264-8703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3268-8679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3332-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3352-8118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3380-8625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3404-8238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3440-8583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3456-8420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3508-8290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3540-1865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3576-5601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3792-8667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3804-8480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3920-8655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3952-8734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3952-8740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4056-8295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4060-8511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4072-8733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4128-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4132-8697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4156-651-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4156-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4156-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4156-2425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4156-6996-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4288-8468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4324-15-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4324-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4352-8330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4364-8619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4376-8208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4404-8378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4412-8300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4428-8218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4472-8280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4484-8143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4544-8715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4548-8148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4560-8637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4628-8123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4652-8571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4656-8275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4656-8270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4680-8233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4716-8426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4796-8649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4816-8193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4868-2480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4900-8673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4924-6070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4928-8163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4936-8090-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4956-6078-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4968-156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4976-8128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5176-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5196-8384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5264-8601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5280-8101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5296-8348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5304-8153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5336-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5344-6194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5356-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5360-8198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5412-8223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5468-8492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5496-8727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5532-8178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5564-8438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5604-8709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5628-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5636-8113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5644-8535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5720-8228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5808-8529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5832-8613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5884-8559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5908-8360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5980-8342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5984-8661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/6012-8565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/6016-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/6044-8444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/6076-8366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                Download