Overview

overview

7

Static

static

3

2025-07-02...op.exe

windows10-2004-x64

7

2025-07-02...op.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250610-en
  • resource tags

    arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/07/2025, 03:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
  • Size 5.0MB
  • Sample250702-d3dpysslx9
  • SHA256 87b6f408ad747c36db6b2afb0b4ce6104f06651f8163d28d4b1ba49a154570d5
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3340
      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:996
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a736B.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2764
          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5076
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74B3.bat
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2232
              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2836
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75EB.bat
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3800
                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                    8⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:6048
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7733.bat
                      9⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4528
                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                        10⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5068
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a786C.bat
                          11⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5116
                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                            12⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:4520
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79A4.bat
                              13⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5352
                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                14⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1032
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7ADD.bat
                                  15⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3476
                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                    16⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2484
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BF6.bat
                                      17⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2360
                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                        18⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:912
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D2F.bat
                                          19⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4724
                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                            20⤵
                                            • Executes dropped EXE
                                            PID:5752
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E48.bat
                                              21⤵
                                                PID:5704
                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                  22⤵
                                                  • Executes dropped EXE
                                                  PID:3488
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F80.bat
                                                    23⤵
                                                      PID:5544
                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                        24⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1108
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a809A.bat
                                                          25⤵
                                                            PID:3736
                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                              26⤵
                                                              • Executes dropped EXE
                                                              • Drops file in Windows directory
                                                              PID:4460
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a828E.bat
                                                                27⤵
                                                                  PID:2160
                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                    28⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    PID:1916
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83B7.bat
                                                                      29⤵
                                                                        PID:5488
                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                          30⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Windows directory
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:6068
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84D0.bat
                                                                            31⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4736
                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                              32⤵
                                                                              • Executes dropped EXE
                                                                              PID:5780
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85E9.bat
                                                                                33⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3544
                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                  34⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:1464
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a878F.bat
                                                                                    35⤵
                                                                                      PID:1164
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                        36⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:356
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88C7.bat
                                                                                          37⤵
                                                                                            PID:1864
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                              38⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2812
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89D1.bat
                                                                                                39⤵
                                                                                                  PID:3068
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                    40⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5664
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8ACB.bat
                                                                                                      41⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:5252
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                        42⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:2196
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BE4.bat
                                                                                                          43⤵
                                                                                                            PID:3724
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                              44⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:5360
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D3C.bat
                                                                                                                45⤵
                                                                                                                  PID:2576
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    46⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:3984
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D7B.bat
                                                                                                                      47⤵
                                                                                                                        PID:2996
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                          48⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:972
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DC9.bat
                                                                                                                            49⤵
                                                                                                                              PID:1852
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                50⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:1756
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E26.bat
                                                                                                                                  51⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1720
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    52⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:3004
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E94.bat
                                                                                                                                      53⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3716
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        54⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:5324
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EE2.bat
                                                                                                                                          55⤵
                                                                                                                                            PID:760
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              56⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1292
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F30.bat
                                                                                                                                                57⤵
                                                                                                                                                  PID:3420
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    58⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:3704
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F7E.bat
                                                                                                                                                      59⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:5864
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        60⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2124
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FCC.bat
                                                                                                                                                          61⤵
                                                                                                                                                            PID:656
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              62⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:4424
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a903A.bat
                                                                                                                                                                63⤵
                                                                                                                                                                  PID:6036
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    64⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:2552
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9078.bat
                                                                                                                                                                      65⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4608
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        66⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:5900
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90B7.bat
                                                                                                                                                                          67⤵
                                                                                                                                                                            PID:1712
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              68⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:5200
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9114.bat
                                                                                                                                                                                69⤵
                                                                                                                                                                                  PID:3564
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    70⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:4572
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9163.bat
                                                                                                                                                                                      71⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4568
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        72⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:5476
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91B1.bat
                                                                                                                                                                                          73⤵
                                                                                                                                                                                            PID:4068
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              74⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:4012
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91EF.bat
                                                                                                                                                                                                75⤵
                                                                                                                                                                                                  PID:4316
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:5456
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a923D.bat
                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                        PID:3612
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:1328
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a928B.bat
                                                                                                                                                                                                            79⤵
                                                                                                                                                                                                              PID:6096
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:3376
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92DA.bat
                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                    PID:4840
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:4876
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9337.bat
                                                                                                                                                                                                                        83⤵
                                                                                                                                                                                                                          PID:5108
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            84⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2268
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9376.bat
                                                                                                                                                                                                                              85⤵
                                                                                                                                                                                                                                PID:4720
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:2360
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9451.bat
                                                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                                                      PID:5484
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        88⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:4904
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9635.bat
                                                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                                                            PID:3368
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4916
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9700.bat
                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:5700
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:4900
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97DB.bat
                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                      PID:5988
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:2196
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9877.bat
                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                            PID:5376
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:2264
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98B6.bat
                                                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                                                  PID:5924
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:2520
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98F4.bat
                                                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                                                        PID:4592
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:4468
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9933.bat
                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                              PID:1880
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:5256
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9981.bat
                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                    PID:3128
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:2016
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99BF.bat
                                                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:2936
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:5324
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99FE.bat
                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                              PID:3560
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                PID:2132
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A4C.bat
                                                                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                                                                    PID:4968
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:396
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A7B.bat
                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                          PID:648
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:1016
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AD8.bat
                                                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                                                PID:5080
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:1612
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B17.bat
                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                      PID:4932
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:5484
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B55.bat
                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:1096
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BB3.bat
                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                PID:1040
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:1000
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C21.bat
                                                                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:3564
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                      PID:6080
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CBD.bat
                                                                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                                                                          PID:4916
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:2812
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DA7.bat
                                                                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:3400
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                PID:2328
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA057.bat
                                                                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3300
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                      PID:612
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA160.bat
                                                                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:2572
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:2172
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA21C.bat
                                                                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:5280
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:4512
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2E7.bat
                                                                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2504
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:5004
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3B2.bat
                                                                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5052
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2664
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA46E.bat
                                                                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4860
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:1184
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA529.bat
                                                                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5816
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:6016
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5E5.bat
                                                                                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3472
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:752
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:556
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA71D.bat
                                                                                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA894.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA950.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1028
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2144
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA0B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:232
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3596
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA88.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB34.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB82.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABFF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACCA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD28.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADE3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE51.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB006.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB054.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB093.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB15E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1DB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB248.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB314.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB352.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB44C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB49A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB546.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB650.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB74A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7A7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB853.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB92E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC227.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC35F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC459.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC515.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC563.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC63E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC69C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC747.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC813.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC880.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC92C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC97A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA93.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4720
                                                                                                                                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Drops startup file
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                      PID:2692
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                        PID:4260
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:4568

                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                        $$a736B.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a736B.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 3da87f3a687f6c7dcd88c74188f2a2dda380c9e7078a64b0f42298e406b169e7
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a74B3.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a74B3.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 47a6b6492dfe3721b7ba78db2aff21c592d204ae7139ed810d2f7d983cb5de48
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a75EB.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a75EB.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 06c3525ac380291ea46fba2d6a96fcbc07828b2d7eff88fcec4a8ed876b45464
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a7733.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7733.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 f978ffd244c21735110ae93437f0c7c10ccc7b3aaadefa9e4f7cd1d24c81dd8f
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a786C.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a786C.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 b7fd886d8db679a1f877729d5b0bb1e3e9be19e59f486c4af66ca2882f11ba5d
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a79A4.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a79A4.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 d9c0aa9e0f36504cded110d13baff139279f01ed07663a7a086885f0d798faf3
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a7ADD.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7ADD.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 aafafc5fc6e955e7bb4dc15a322709c668b502adb677fead031abd696955bb13
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a7BF6.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7BF6.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 fb3a92a3c499f9fff51bcf28405778dd295a99eb30c7c9c700ef8ab5396b3c41
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a7D2F.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7D2F.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 b1c62637e5178d8d0718cf387023f9ae0588e4b332849be882aa05fd8a4ff15e
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a7E48.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7E48.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 e3452f1cca866f86d9a92edc492b2a7a8fa3836d0a9962cb3f75b3167828fc08
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a7F80.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7F80.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 8a32abf0273e543f96508b0d61cb527b0c56dbc567b15ced0aeeef56b3d24c65
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a809A.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a809A.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 bbd16cd784a1870e1ff237bfd64db88e31e1dcba09c8f575d93c2e323e7db887
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a828E.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a828E.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 83420d2e6f9026094c670f7e220fe67ecdc8ebfefc1946f69b438d95ae32342d
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a83B7.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a83B7.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 1725158c7f90364260969ce96cfa2dcaa10a1394f37bc8024bbfbf496768dcad
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a84D0.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a84D0.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 02f6a161551ef59651aaca6811b20971497835af9313aac09ad235d19e487e08
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a85E9.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a85E9.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 568344b6c0a68efd7be70579d66e8a41d2b37c2a2d822439dd618e69ad2ba6b5
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a878F.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a878F.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 77c466e6c3cf287ec38267fb481b78a8b257bdcf67b92140ff29455f14aa6641
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a88C7.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a88C7.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 e8d4b6f2ba1550c7d0e491927ac403c355bbfe6b008931dd6a635f227fa63063
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a89D1.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a89D1.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 5e5c19769e920d098a45971b48fd39ba42b5b4bfca1a84702d9491e1a76dc921
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a8ACB.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a8ACB.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 e579ead147b1ed1dbfd8d16d5dbe339de4966335953bfb8fa3021e13720b6772
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        $$a8BE4.bat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a8BE4.bat
                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                        • SHA256 4520a8fa1be1aa76257907cef095d8a3b25aa288fe345430f57c9ad1a6a19c5b
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.5MB
                                                                                                                                                                                                                                                                                                        • SHA256 82b31e925493980542d8500ebc4efa6f53c1c7121b98b59c68ef711b44f4e057
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.9MB
                                                                                                                                                                                                                                                                                                        • SHA256 af1a9b4dc1a0603cb8d82465cda62e9e8e5776fc12dccdef442adcc8af7af8fb
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.9MB
                                                                                                                                                                                                                                                                                                        • SHA256 cefcefd4b76c6057c5e4adbfa53e2e77de8ba4fe00549ce7a5952f7eff005973
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.7MB
                                                                                                                                                                                                                                                                                                        • SHA256 e82dc11db5e368f864214a1c1632b8bec256a3e6e9251ade10bb2acb15f83a9c
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.5MB
                                                                                                                                                                                                                                                                                                        • SHA256 6635ae34d3354d39ca844b4962a284ff2f178f764f3fc8f8907c59692c996f00
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.4MB
                                                                                                                                                                                                                                                                                                        • SHA256 6fac6ed38c0b1315ed662043fdafd6e499fd5eb35598a38299dbdaac3022213a
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.9MB
                                                                                                                                                                                                                                                                                                        • SHA256 03c0cf3ded5f31db8c4074f7a6ccb1362470c63ce6438977c7bb95f106190d0d
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                                                                                                                                                        • SHA256 8d20121f552f45e4ccbcb8e82f17702d491281556116f4733e3cb041643fb6ae
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.6MB
                                                                                                                                                                                                                                                                                                        • SHA256 17196f1d59a8887168f8432d86aaa12402279bb74f42616297dfd99a2fcfab27
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.3MB
                                                                                                                                                                                                                                                                                                        • SHA256 da7888661830c47280e318ceaaa3ad2c6ee83b837359bb5520369847c3a03566
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                                                                                                                                                        • SHA256 617670ea14a1bee928e35179461e621a748733ae54579f10e7fa9476746fe819
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                                                                                                                                                        • SHA256 3f45a0a5154d3d23c64942ea6890a306f3308a95fcd806074a10aeef18570af2
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.7MB
                                                                                                                                                                                                                                                                                                        • SHA256 76ffa186c33c1a6887f0d53c4e9a5b1b2d7ad35ad8018492351025c9fbf23b75
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.7MB
                                                                                                                                                                                                                                                                                                        • SHA256 b8f468666866e9d358805677b7171aa8a9c2264e9c462792f766a7a89b98bb0f
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.6MB
                                                                                                                                                                                                                                                                                                        • SHA256 eaa296f7df6b8458bdbcc57f8d3ff9156b2685276c9a39f57ac895f5654edb7f
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.6MB
                                                                                                                                                                                                                                                                                                        • SHA256 497ba926c05ef9a7c2816b930ccec8a2a48f675fb727c8ce257673d378a55ebb
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.5MB
                                                                                                                                                                                                                                                                                                        • SHA256 bdb5725bc4666ed43ca0392f8f18c9991fd19f4bce5a4bb9097f0021db72ab7e
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.4MB
                                                                                                                                                                                                                                                                                                        • SHA256 548ba6fc2b1205acea73832c765df974befadadb2c07e3916ce362b3b1e30088
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.4MB
                                                                                                                                                                                                                                                                                                        • SHA256 9e7d52450eb305fa1d3a94acc0add00d8e2b748c11decb4da26cab766747e20d
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_4e44002c76c4b355fc429fdd12201441_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                        • Size 4.3MB
                                                                                                                                                                                                                                                                                                        • SHA256 7b03ca34a1078dabe332139c58afde6bb897474efb49d1ff61d7e65b58488bc8
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Logo1_.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        _desktop.ini
                                                                                                                                                                                                                                                                                                        • Path F:\$RECYCLE.BIN\S-1-5-21-2340264150-4060318110-2688614100-1000\_desktop.ini
                                                                                                                                                                                                                                                                                                        • Size 8B
                                                                                                                                                                                                                                                                                                        • SHA256 7ee98acf971e32cae894381122352197a76e04e7689903e61cef63ad4f690736
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        memory/8-10695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/356-147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/396-2027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/556-4956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/612-3269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/656-6444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/760-9179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/912-77-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/972-183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/996-8-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/996-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1000-2048-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1016-2032-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1016-4830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1032-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1036-5861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1044-10740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1108-99-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1156-8315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1184-4444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1212-10766-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1212-10761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1228-6434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1292-199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1328-6370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1328-245-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1356-6400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1356-5846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1368-6395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1408-5831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1464-140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1496-5866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1560-5836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1560-6390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1572-6405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1572-5851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1612-2036-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1708-8771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1756-187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1904-10675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1916-117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/1968-10730-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2016-2015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2124-209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2132-2023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2144-5740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2160-5559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2172-3500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2196-170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2196-1995-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2264-1999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2268-257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2328-2840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2336-10725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2360-500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2388-5856-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2388-6410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2480-7754-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2484-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2496-10735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2520-2003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2552-217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2576-10685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2604-10715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2664-4239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2668-10720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2692-2028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2692-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2692-88-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2716-6385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2732-5978-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2764-6464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2812-2554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2812-154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2836-26-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2856-10705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2876-6439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/2964-6692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3004-191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3108-6424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3168-5826-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3168-6380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3312-6429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3364-5340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3376-249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3408-10750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3428-10690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3480-10082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3484-6479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3488-92-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3512-6365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3596-6375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3596-5821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3652-8950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3704-203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3788-6449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3804-10447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3928-10710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/3984-179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4012-237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4148-6469-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4416-10680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4424-213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4424-8576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4456-10700-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4460-110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4468-2007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4512-3706-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4520-49-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4572-229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4632-7055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4676-2044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4684-6459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4704-9715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4820-6474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4876-253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4900-1899-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4904-1355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/4916-1641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5004-3936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5060-8058-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5068-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5076-19-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5200-225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5228-6415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5256-2011-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5324-195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5324-2019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5360-175-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5456-241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5476-233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5484-2040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5544-10745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5664-161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5700-5841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5736-7360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5752-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5780-131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5876-6454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5900-221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5916-10760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/5920-10755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/6016-4617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/6048-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/6068-124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/6080-2208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                        memory/6084-5169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                        Download