Overview

overview

7

Static

static

3

2026-08-05...op.exe

windows10-2004-x64

7

2026-08-05...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 19:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
  • Size 3.5MB
  • Sample260805-x2eqeaep7z
  • SHA256 d59cd89774950523302ffd230de9933b8da60de58ba6076553196bce2ae6aa58
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EF6.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3488
      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1800
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a337A.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3056
          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:540
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a358D.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:124
              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2028
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37B0.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1324
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:5760
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3994.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5996
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:6060
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B59.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1248
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:5756
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D5D.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5868
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:2968
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F32.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:2144
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:2340
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4116.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:5184
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:848
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4339.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:1336
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:1756
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44FE.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:6096
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:3196
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A7C.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4252
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4888
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5068.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4872
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1848
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a523D.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5444
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1216
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54AE.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3840
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3736
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a649C.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1228
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2676
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a679A.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4356
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4052
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6911.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2128
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2140
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E41.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1860
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5928
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7064.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:856
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4920
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a715E.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5908
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2560
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7323.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2324
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4592
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73DE.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:784
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:6056
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a749A.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2524
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3288
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7594.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1696
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4712
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F87.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4456
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4840
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8042.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4800
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2992
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a814C.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5988
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:820
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81F8.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1628
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1512
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82A3.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2204
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4204
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a835F.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1968
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2920
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a841A.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:2644
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:808
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84C6.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:5716
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2160
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8582.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:5004
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:4992
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a866C.bat
                                                                                                                                                70⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4212
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4132
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8718.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:2428
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4868
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87C4.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:3856
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:3192
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a889F.bat
                                                                                                                                                            76⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:3008
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5200
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a893B.bat
                                                                                                                                                                78⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3844
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  79⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:3168
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89E7.bat
                                                                                                                                                                    80⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:5740
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                      81⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:3492
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AD1.bat
                                                                                                                                                                        82⤵
                                                                                                                                                                          PID:3588
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:5272
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B9C.bat
                                                                                                                                                                              84⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:3152
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                85⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:2496
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C48.bat
                                                                                                                                                                                  86⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:4148
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    87⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:2900
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D13.bat
                                                                                                                                                                                      88⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:2464
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        89⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:4064
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E2D.bat
                                                                                                                                                                                          90⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:3216
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            91⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:5528
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EE8.bat
                                                                                                                                                                                              92⤵
                                                                                                                                                                                                PID:2552
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:936
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FA4.bat
                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                      PID:5780
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:200
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a905F.bat
                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:248
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:3800
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a910B.bat
                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:2184
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:5108
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91B7.bat
                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:4996
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:1708
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9272.bat
                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:5280
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:992
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a936C.bat
                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:4604
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:1796
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9409.bat
                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:2656
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:3388
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94B4.bat
                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:6052
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:5072
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9580.bat
                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:4408
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a961C.bat
                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:5720
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:3900
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96C8.bat
                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:768
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:4236
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9764.bat
                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                    PID:3136
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:1784
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9800.bat
                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:5076
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:4548
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98BC.bat
                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                              PID:5648
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:1740
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9996.bat
                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:4756
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:2220
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A23.bat
                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                        PID:4140
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:828
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ACF.bat
                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:4160
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:6068
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B5C.bat
                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:3360
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:5816
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C17.bat
                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:2284
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                        PID:3836
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CB3.bat
                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:3908
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                              PID:4688
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D6F.bat
                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:5044
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:3680
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E1B.bat
                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:5332
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:2640
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EB7.bat
                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:1476
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:5932
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F53.bat
                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:5632
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:5388
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FEF.bat
                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:2636
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:2940
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA07C.bat
                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:5516
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:1048
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA118.bat
                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:4532
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                            PID:5508
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1C4.bat
                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                PID:3936
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:2520
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA29F.bat
                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:3556
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:1664
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA37A.bat
                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:2632
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:5016
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA426.bat
                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:3144
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA520.bat
                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:3068
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6136
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5DB.bat
                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:4248
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:1072
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA697.bat
                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:5732
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5216
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA733.bat
                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4184
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1452
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7CF.bat
                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:748
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:5588
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA85C.bat
                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:2988
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5896
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA917.bat
                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2356
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1964
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9A4.bat
                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:1616
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:6124
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA40.bat
                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAABD.bat
                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC15.bat
                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:952
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF51.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFFD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB135.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4668
                                                        • C:\Windows\Logo1_.exe
                                                          C:\Windows\Logo1_.exe
                                                          2⤵
                                                          • Creates a file in the Startup directory
                                                          • Executes dropped EXE
                                                          • Enumerates connected drives
                                                          • Drops file in Program Files directory
                                                          • Drops file in Windows directory
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4808
                                                          • C:\Windows\SysWOW64\net.exe
                                                            net stop "Kingsoft AntiVirus Service"
                                                            3⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4848
                                                            • C:\Windows\SysWOW64\net1.exe
                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3396

                                                      Network

                                                            MITRE ATT&CK Enterprise v16

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            $$a2EF6.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2EF6.bat
                                                            • Size 776B
                                                            • SHA256 9b05b58f79adf72e5b0268ed8975f9f8e60036072c3b08a918b10c58cba008fd
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a337A.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a337A.bat
                                                            • Size 776B
                                                            • SHA256 d47c59a7bef4bfca3a3a54869e0f07d11b80a369cfcaee9d70a9804de5eaa87e
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a358D.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a358D.bat
                                                            • Size 776B
                                                            • SHA256 b550788d3e800fdeda692152f63a21e53a6ee2c2b81dc0773bb125fe521cae4f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a37B0.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a37B0.bat
                                                            • Size 776B
                                                            • SHA256 87f7397e8a5f4f596309d6077afe901c877c8100587d5a79407d7a95ff4f8f35
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a3994.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a3994.bat
                                                            • Size 776B
                                                            • SHA256 0abe7f062d8dc121918290245633ff7a7a07e70ce2e666b3853f4567ab186c5b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a3B59.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a3B59.bat
                                                            • Size 776B
                                                            • SHA256 00c5b06f151aba421571fcc0fcca57956152f7a4de1ffc67285d857d1539460f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a3D5D.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a3D5D.bat
                                                            • Size 776B
                                                            • SHA256 74d4c5b1c56d579cf7059e9f6690fb47c4f632bbe63f5d4719c9c9c16545e17a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a3F32.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a3F32.bat
                                                            • Size 776B
                                                            • SHA256 c29c65dc2dcd789ba22737df5f54902bbc21cb35d56b0e5c415b431bd4380a12
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a4116.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4116.bat
                                                            • Size 776B
                                                            • SHA256 b1742f27355eca234603a3f1e2814c1d712e56a22a181239bf8946f8af9fdd26
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a4339.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4339.bat
                                                            • Size 776B
                                                            • SHA256 3cae957903c1964d1fd2f79bc743ba40bbbf43a755d6a0e4e59879ef777dd6ba
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a44FE.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a44FE.bat
                                                            • Size 776B
                                                            • SHA256 26c3a85066f3e93318a39695723c6bc7ac9c42a60977621f32245f5d3ca18bb8
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a4A7C.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4A7C.bat
                                                            • Size 776B
                                                            • SHA256 11c91377ba18ee103aec64144f9d3dc74e751605b838eb9d83c3e73e36d9f95f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a5068.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a5068.bat
                                                            • Size 776B
                                                            • SHA256 1b4203a605861d7acd0bbb312a749e0eff3bc1a22e72fed1ce3855927d6747f2
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a523D.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a523D.bat
                                                            • Size 776B
                                                            • SHA256 d61bd612db1ae776bf148364cba4a9b3c1ffb854884c6578a37ca9ac3a7a3be5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a54AE.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a54AE.bat
                                                            • Size 776B
                                                            • SHA256 546b0bc5852af763391f17191bba240201d8bb995b749fb82abdb605ab05be3b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a649C.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a649C.bat
                                                            • Size 776B
                                                            • SHA256 48b1ed1117e2743807c4eafbc85add421f2d5480aabcd30b520c76aa2348c1d5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a679A.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a679A.bat
                                                            • Size 776B
                                                            • SHA256 dabc7547258600c5bb96a4760553e564a2290981caeaf11d6ca7b20949c12d55
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a6911.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6911.bat
                                                            • Size 776B
                                                            • SHA256 1b5bf70746546b2e9e62c41c3aec16010d85298a3b15c6df70177202310273d6
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a6E41.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6E41.bat
                                                            • Size 776B
                                                            • SHA256 083af7bd07531f7c8c1f8a7c98ae7a51f1a641205a7460a9fb81ff7cf7e8d091
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a7064.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a7064.bat
                                                            • Size 776B
                                                            • SHA256 07b12ddd59596858178d73a315f0e9a49197971fa72e2d83c1d43134df4663dd
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            $$a715E.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a715E.bat
                                                            • Size 776B
                                                            • SHA256 c9bfa4030ea1427e423b5713af6eee60991fd8f7b93e0c1aa4fca82d6b0a22b7
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.0MB
                                                            • SHA256 8e4f3bbcd67b3967ef708ff6c194ba519cb6c48382d7a9a8001ea47b269aee1f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 2.9MB
                                                            • SHA256 d35844ac4397d68016051bbef52321318daad43dff2dd6ac4ddbaa7f9f1768c1
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 2.9MB
                                                            • SHA256 bf45fe2d49fb01be686bb1421a6e06db94fe54de0ef088d0d286ab1ba5333ff2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.0MB
                                                            • SHA256 0c1f1530489f2f3a3b67ac0891b9d184c0954707a589ed575115e25f47934b49
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 2.9MB
                                                            • SHA256 5db5fb0fdd7f8bee25ccb28075b7f7ee3819b3c8c9ee204a8f91b585dc6d363e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.0MB
                                                            • SHA256 18ee8cab97c0ee0df7a57c8486c1476101caae4ea3a8bcd2e1de5d456ba7b4b2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.1MB
                                                            • SHA256 804bece034369f29e6cf5564857bda338adb7296c7d49d2498e63ef688bb9134
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.3MB
                                                            • SHA256 bfc4743fb04b3cbbde18fffc89abac19d5bc25b874e4a527b8b3321ce903acee
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.1MB
                                                            • SHA256 6cf2cab1e5c16dd911cd189b10548d3d625d376163b13fdc4aaad6982de24868
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.5MB
                                                            • SHA256 998468d3eea39e2de533e8cadfe6e0cdff628897982507e34190a0126cb2b5d7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.4MB
                                                            • SHA256 72e955e9bddf007c8d1f23db4c212d721f774d52bcde1dca5d77699ca11ca9f8
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.4MB
                                                            • SHA256 666484f1f5146dbe7f6cd7a040c59e8fd9509eb3d8fb59a55c6f9e1fd5699c0a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.3MB
                                                            • SHA256 ebac14c9f450045f8da6ad600596d43adf7eafc81bbc7e0b7f0f2f79a39db981
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.2MB
                                                            • SHA256 5c97aa7a648fcb7cc397c5e7c93b33783d2f17d76b6393cb177ec757a6d840cd
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.4MB
                                                            • SHA256 495d16f4faf4a6dd107c5a3dafac0907b37a5b384e8b0c2540810a065017677a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.3MB
                                                            • SHA256 c8a1fde5a64b759d57a057db21f9f969ebc3c7ba1945b3864c8129ad4ae0c174
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.2MB
                                                            • SHA256 53524f5332e94fa87e546a5d7d15359c1bf45940fef481f0e3d4238e3e4f3f7f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.3MB
                                                            • SHA256 d8d7d5490342d94cedeb0565b6ad3e05b2984f2eaaf2623859e178b45a6702e0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.1MB
                                                            • SHA256 670e45f2ed6cf50ab4d64b2a9455f23302754cdae7ca325fee2db80cffa46796
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_08c7ac2d179c5405e21c732b610dbaf9_amadey_elex_smoke-loader_stop.exe.exe
                                                            • Size 3.2MB
                                                            • SHA256 d749359e7b397cd62e9fe70d0787f3bf2f5a7b9e51b8a6b54a677d7ee544465f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Logo1_.exe
                                                            • Path C:\Windows\Logo1_.exe
                                                            • Size 32KB
                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            _desktop.ini
                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-552508041-2681165170-3229858294-1000\_desktop.ini
                                                            • Size 8B
                                                            • SHA256 f8845463e517b9c7e2ddf8679d58b32bd33b33e81d6658d22009f4c9d0a69d85
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            memory/200-8326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/540-32-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/808-8251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/820-8229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/828-8402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/848-101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/936-8321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/992-8346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1048-8462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1072-8505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1100-8553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1216-2017-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1224-8602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1224-8608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1308-8571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1452-8517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1512-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1664-8480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1708-8341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1740-8391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1756-110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1784-8381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1796-8351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1800-22-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1848-1889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1868-8559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/1964-8535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2028-1567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2028-41-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2140-6094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2160-8256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2220-8396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2340-91-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2496-8301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2520-8474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2560-6120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2640-8438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2676-5617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2900-8306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2920-8246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2940-8456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2968-83-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/2992-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/3168-8286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/3192-8276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/3196-780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/3224-8565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/3288-6135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/3388-8356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/3492-8291-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/3680-8432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/3736-5609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/3800-8331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/3836-8420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/3900-8371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4052-5625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4064-8311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4132-8266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4196-8547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4204-8241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4236-8376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4408-8366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4548-8386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4592-6125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4628-8577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4688-8426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4712-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4808-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4808-105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4808-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4808-2523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4840-8219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4868-8271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4888-1881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4900-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4900-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4920-6110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/4992-8261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5016-8486-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5072-8361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5108-8336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5200-8281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5216-8511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5272-8296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5388-8450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5508-8468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5528-8316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5548-8601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5588-8523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5756-75-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5760-55-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5816-8414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5896-8529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5904-8583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5928-6102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/5932-8444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/6008-8492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/6012-8595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/6016-8589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/6056-6130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/6060-63-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/6068-8408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/6124-8541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download

                                                            memory/6136-8499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                            Download