Overview

overview

7

Static

static

3

2026-09-23...op.exe

windows10-2004-x64

7

2026-09-23...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 07:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
  • Size 4.3MB
  • Sample260924-jb2wcsvy2n
  • SHA256 ce157896de31e45f0dd1195e87e716291e690b67cc75f69e5eb60d4f6010d75a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6016
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a891.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5448
      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4428
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4B.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5420
          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:3300
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0A.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2736
              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4636
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11F8.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4936
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:364
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a163D.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5876
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:5268
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A93.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3216
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:4688
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a258F.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5724
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3752
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27D1.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1076
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4092
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3965.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4944
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:1956
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AAE.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4340
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:2444
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C8B.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:3368
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:1180
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E1D.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1432
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3824
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9159.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4588
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2840
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9476.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3836
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4152
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9764.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3528
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2160
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A04.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4888
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4168
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CD3.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2652
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:124
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F92.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5440
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2764
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA195.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5048
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5144
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3D7.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1200
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3904
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5BC.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5936
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4116
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7A0.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5540
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3212
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA88B.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4388
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4572
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA985.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:6120
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5156
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA5F.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1524
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3896
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB4A.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4284
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3104
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC15.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3936
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5160
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD0F.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1680
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:916
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADF9.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2608
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3888
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEB5.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:700
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5748
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF9F.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:200
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:5444
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB089.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:3064
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:1208
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB164.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:4592
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:4512
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB23F.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:4848
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1392
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB30A.bat
                                                                                                                                              70⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:2780
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:2808
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3D5.bat
                                                                                                                                                  72⤵
                                                                                                                                                    PID:5172
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:5124
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4C0.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:3456
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:2800
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB57B.bat
                                                                                                                                                            76⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:1120
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:4068
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB627.bat
                                                                                                                                                                78⤵
                                                                                                                                                                  PID:5788
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:620
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB711.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:876
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:3668
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7BD.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:4328
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:1388
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB869.bat
                                                                                                                                                                              84⤵
                                                                                                                                                                                PID:2804
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:2116
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB953.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:1540
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:3436
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA0F.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:2448
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:4172
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB09.bat
                                                                                                                                                                                            90⤵
                                                                                                                                                                                              PID:5756
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:4672
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBB5.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:5056
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4144
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC61.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:5292
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:5844
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCFD.bat
                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:1028
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:1788
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDA9.bat
                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                PID:5360
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:4208
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE64.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                      PID:6032
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:764
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF10.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:3384
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4628
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFAC.bat
                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:5128
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:2536
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC087.bat
                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:2648
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:1324
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC123.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                        PID:2664
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:4480
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1C0.bat
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:3016
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:4684
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC28B.bat
                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                  PID:1436
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:6124
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC356.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:2552
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:5180
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC421.bat
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:3372
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:2672
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4FC.bat
                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                PID:4212
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:476
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5B7.bat
                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4824
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:1892
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC692.bat
                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:5784
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:4880
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC74E.bat
                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:5744
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:940
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7EA.bat
                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:4784
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:1532
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8B5.bat
                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:5108
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                        PID:4664
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC990.bat
                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                            PID:2136
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:4728
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA4B.bat
                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                  PID:800
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:1996
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAF7.bat
                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                        PID:4156
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:5412
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBB3.bat
                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                              PID:1116
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                  PID:576
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC5E.bat
                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:2120
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:2376
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD39.bat
                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                          PID:2260
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:3708
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDD5.bat
                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:2308
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                  PID:2824
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE91.bat
                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:1440
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:2612
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF4C.bat
                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:5088
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                            PID:2000
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD018.bat
                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:3344
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4412
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0B4.bat
                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3396
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:3804
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD19E.bat
                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:2864
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:4744
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD23A.bat
                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:2004
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:6116
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2F6.bat
                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1920
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:4836
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3C1.bat
                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:5824
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5520
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD46D.bat
                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1164
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:6136
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD528.bat
                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:5968
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5D4.bat
                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5324
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD661.bat
                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:564
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD799.bat
                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD865.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD901.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA59.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB14.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBB0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5376
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC5C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3740
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD08.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDB4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE60.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE006.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE15D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE209.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE380.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE46B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE507.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE594.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE63F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE759.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE824.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE96C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA18.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA95.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBAE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE2F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEBB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF48.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3956
                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                  2⤵
                                                                                                                  • Creates a file in the Startup directory
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Enumerates connected drives
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5820
                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                    3⤵
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4940
                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                      4⤵
                                                                                                                        PID:1436

                                                                                                                Network

                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      $$a11F8.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a11F8.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 5dd4ce3cc880f27eccba0a7e08978a11d11c71d2344fcc66c4c20f80e5be3410
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a163D.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a163D.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 d7792811f8f885d1aa8f947f6e083935dcc7184f20ce71940be01c5925956203
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a1A93.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1A93.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 6a2b78816a23cb3d428748d9d39e0cc4856e4313bec53ad8324fa5527d937eaa
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a258F.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a258F.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 a1ae3d69503a51383d6baf138296c8e8ff56e67f115226386e1c812ebf8f6639
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a27D1.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a27D1.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 afa272e7bfa7b64f2b4c0d3a63f8480cf5b220665d2772aaeed70daddbee22d7
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a3965.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3965.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 55e67a6c49c115b277bf386b834633bc946cd8f7eeec5b7e709d915135624fad
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a3AAE.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3AAE.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 957ae856f17e173daf2d6be59bb98f56ccf6bec5ee2d3560fe442e74214a9886
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a6C8B.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6C8B.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 d7bc49d8eb1a045ac074271625dfa1a7f55f3a785c12be7b9aa5b7ab1320a0fd
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a891.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a891.bat
                                                                                                                      • Size 775B
                                                                                                                      • SHA256 18165cabd9b32ce04a089e78a9574df9c919f066b375c4d1b6040979c6f2c334
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a8E1D.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8E1D.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 054d0c2b6d86eed928c6fe486c82db499befe37639040094491b411d9f041dc9
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a9159.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9159.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 698cb77420afdc7fe2f934d435f6751b33c427108680a6c53f194dd90c6ea7f0
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a9476.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9476.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 a9b92805521bbef7d840ad799a90b64126d29937addebbad433da5d62378de2f
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a9764.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9764.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 c5bee0ddd83d8668c0e402777480a97c2003659987a485569835cd40b462a33b
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a9A04.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9A04.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 8e6463ad3fda8e616ee4ea1066a66a3f989e0946a6ff31dfd5f998cd7f704832
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a9CD3.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9CD3.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 db1944bc4b4fda04b197e8572d0d3aea437c99362c36aaa3d3d64a7f45678788
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$a9F92.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9F92.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 4fdaa165e2ba5c97695e8cafd27a7ed70d453f57fad70c52b24834b41b250fef
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$aA195.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA195.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 c10fda1237258daf22b888c1a8bfdeedace3aca117cad65fa29d72981381418a
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$aA3D7.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA3D7.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 73cb0534757a0845bf5ed6316c2ddaf56594208c4ec9ca773c8603274117fc94
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$aA5BC.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA5BC.bat
                                                                                                                      • Size 776B
                                                                                                                      • SHA256 e881bda665e9b613bc68fe1f7dbf6d6529fa0fc1d8792f4f2920c938250321d4
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$aC4B.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC4B.bat
                                                                                                                      • Size 775B
                                                                                                                      • SHA256 fb2adf0558b0c98cd5ca90cb2ce8c5c335fba59b6e04c5d8ef0d9abc6088761a
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      $$aF0A.bat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aF0A.bat
                                                                                                                      • Size 775B
                                                                                                                      • SHA256 32b0c53ef54cfa31ee0237dc1d3efb2f02b6cff1871c1bb06cbd9f37cc0263ba
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 4.0MB
                                                                                                                      • SHA256 59f4bee8029624e9fb167db46cd2ee7b4abb9b4a99cc250b537b2aac9258ba21
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 4.0MB
                                                                                                                      • SHA256 ff129450e315fd65592ac60d3eb7ffcf80bd01d6c3106d0198da4bd1c311a3e4
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 3.9MB
                                                                                                                      • SHA256 6a5e0b191d0de1ac640a8d0f68d7e0e81e12f6b0c443b020e77a2edb77ee4918
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 4.1MB
                                                                                                                      • SHA256 2d17cae42eb60ef26ad100e2981d7689e30dc07a9db92f60eb52cb20c09139d7
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 3.8MB
                                                                                                                      • SHA256 ed6b7411b00602d572974e8bda60f76de1761c5dc2954224f8fb41edb95987d2
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 3.8MB
                                                                                                                      • SHA256 452a6d18dbeec572256bb0ad32e2195111e364b724f4cf8a200a1e8b82834c4e
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 4.2MB
                                                                                                                      • SHA256 6fc59ca0f8173b3d65ba56a96dec26e0da20a7f9b48cf5f23081c638bba1099f
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 3.7MB
                                                                                                                      • SHA256 0fc10aec15cdfc10310a311e249ffd113718d4d224cf0d0e15e1aca9bc63db35
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 4.1MB
                                                                                                                      • SHA256 7b010a10bf054f92c2e3bbfd29a015265735fdaa90fe7f60b0551c33c468fdc5
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 4.3MB
                                                                                                                      • SHA256 34a7cec6f3e36303136cdd93bf727976d7f76471ec4a49e6ecb4efa2d775144d
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 4.2MB
                                                                                                                      • SHA256 28b9b632fb0e8c74ee287e28e3b6a1bd061f01853b958589dd472da9bbe98e42
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 4.1MB
                                                                                                                      • SHA256 e13b976fa6b5e88c2574e776fde07682be5f9c1bb5b9dca9c115389d322ba32a
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 4.2MB
                                                                                                                      • SHA256 a220b1c04ad76f6fae1a009f0b161c200c32c1bf08821db3bf188fb805b014e7
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 4.0MB
                                                                                                                      • SHA256 4aa54dc9b701245141d7b8374b7ddbf5cb5bc3fa7992939c2f79c0800e15b079
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 4.2MB
                                                                                                                      • SHA256 d7f9e898e6b3d517c48372849b274d695964a261a3789d1d1abc1b6a80bd5761
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 3.9MB
                                                                                                                      • SHA256 3afab7e925d45ad4522087d7b56b3ba7ef0adc8512925b31ef283d932a530ca9
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 3.9MB
                                                                                                                      • SHA256 83337352e08fef042f9573e7dd0047e47afebe421b0d43214a6dda0fc6e12cf3
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 3.8MB
                                                                                                                      • SHA256 61ebbc33c4d729afea957311e7b45aaf9085dbeb9e06eae265f3fcaf05bdf429
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 3.7MB
                                                                                                                      • SHA256 f24976fec7db2b7f1dac7cc2fbbc0edf9f67ed0fc96f02dbccd978388ff1d271
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_63cd515a6169592c4af49945f99f4871_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                      • Size 3.7MB
                                                                                                                      • SHA256 fc0760210fb86c27a6cb000a4db54d80f9609a17496c8d5aeabc5adec7b09b55
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Logo1_.exe
                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                      • Size 32KB
                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      _desktop.ini
                                                                                                                      • Path F:\$RECYCLE.BIN\S-1-5-21-1704430598-3087477806-3297458608-1000\_desktop.ini
                                                                                                                      • Size 9B
                                                                                                                      • SHA256 346de4d5debec31c9a445d77ea11610cbefd2c8caf903962fbf17b7ec8847d33
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      memory/124-8206-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/252-8719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/364-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/476-8427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/564-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/576-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/620-8327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/764-8382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/916-8272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/940-8442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/988-8581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1132-8749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1160-8755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1180-8157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1208-8292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1236-8737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1324-8397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1388-8337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1392-8302-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1472-8761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1504-8611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1516-8629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1532-8448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1788-8372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1892-8432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1896-8641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1956-5559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1996-8466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2000-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2116-8342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2140-8665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2160-8190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2272-8767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2288-8695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2376-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2444-8148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2520-8773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2536-8392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2612-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2672-8422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2764-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2800-8317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2808-8307-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2824-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2840-8174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2940-8605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2976-8617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2988-8785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3020-8725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3104-8262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3212-8242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3300-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3416-8791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3436-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3584-8779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3668-8332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3708-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3736-8587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3740-8623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3752-1841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3804-8521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3824-8166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3824-8161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3888-8277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3892-8635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3896-8257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3904-8231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3908-8683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4068-8322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4092-5551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4108-8731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4116-8237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4144-8362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4152-8182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4160-8599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4168-8198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4172-8352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4208-8377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4232-8659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4236-8713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4248-8701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4412-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4428-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4480-8402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4512-8297-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4544-8792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4544-8798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4572-8247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4628-8387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4636-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4664-8454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4672-8357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4684-8407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4688-1832-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4728-8460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4744-8527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4836-8539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4880-8437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4916-8707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5052-8593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5084-8575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5124-8312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5144-8222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5156-8252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5160-8267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5176-8671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5180-8417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5268-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5272-8743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5412-8472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5444-8287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5460-8689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5520-8545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5560-8653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5748-8282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5820-8141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5820-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5820-4190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5820-1833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5844-8367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5968-8557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5996-8677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/6016-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/6016-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/6028-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/6084-8647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/6116-8533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/6124-8412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/6136-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                      Download