Overview

overview

7

Static

static

3

2026-08-12...op.exe

windows10-2004-x64

7

2026-08-12...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 00:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
  • Size 5.0MB
  • Sample260813-a8delayclh
  • SHA256 cb02a0fd0001675ac1457c93c29cec0d0c683a99905a2d612f3acf3c20f27921
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F34.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1644
      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4948
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3445.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4284
          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:3724
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36E5.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3956
              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:2120
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AAE.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2168
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3268
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CE0.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5808
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:2456
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F51.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2844
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1552
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41D2.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4684
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:4428
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4462.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2836
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:6128
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4963.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4228
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:3216
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a521E.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:1740
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:5344
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56A2.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:5544
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:5080
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CCC.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4092
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3172
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6075.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5944
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4624
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63F0.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4956
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4452
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66AF.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1596
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3124
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6911.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3292
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5332
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BA1.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:760
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4560
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DD3.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1528
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:624
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7044.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3236
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5684
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7267.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3248
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1328
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7380.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5700
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4216
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a747A.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5676
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3924
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7574.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1728
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3836
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a769D.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4764
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3288
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77C6.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5064
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5364
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78A1.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1864
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5852
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79CA.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5948
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4440
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AA5.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4732
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1192
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B7F.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4984
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:4136
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C5A.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4436
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:3980
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D54.bat
                                                                                                                              62⤵
                                                                                                                                PID:2256
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1324
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E1F.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:2068
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:5424
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EFA.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:3260
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:5504
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8004.bat
                                                                                                                                              68⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1108
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4752
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a811D.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:2416
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4164
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81D8.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:5796
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:4260
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82B3.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:1720
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:5844
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a838E.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5744
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:5000
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8469.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:3372
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:5800
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a860E.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4988
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:784
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86CA.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:1784
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:5664
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87B4.bat
                                                                                                                                                                                    84⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2476
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1308
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a889F.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3868
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5464
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a894B.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                              PID:5784
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:3112
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A06.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:3340
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:3180
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AC2.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                        PID:3132
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:1548
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BAC.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                              PID:5180
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:2928
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C77.bat
                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                    PID:4552
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:5780
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D23.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:3880
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:2860
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DDE.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:1408
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:3592
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E9A.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:4724
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:4952
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F46.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:5704
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9021.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:4600
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:5336
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90DC.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                PID:236
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:4528
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9198.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                      PID:5628
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:5220
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9272.bat
                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:2508
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:1068
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a934D.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                PID:1948
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:4620
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9409.bat
                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                      PID:5716
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:1592
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94E3.bat
                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                            PID:2148
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:2640
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95AE.bat
                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                  PID:2712
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:3900
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a965A.bat
                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:4748
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:3316
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9725.bat
                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:4184
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:4892
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97E1.bat
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                PID:4828
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                    PID:2320
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a989C.bat
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:1704
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                          PID:3732
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9977.bat
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:3864
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                PID:1176
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A52.bat
                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                    PID:4816
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                        PID:2764
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B2D.bat
                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                            PID:4692
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C17.bat
                                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:4272
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:5816
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CC3.bat
                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                      PID:5248
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:2932
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D7E.bat
                                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:4128
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                              PID:3808
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E4A.bat
                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                  PID:928
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    PID:2720
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F24.bat
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:5324
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5500
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FD0.bat
                                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:5916
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:1876
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA07C.bat
                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2736
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6020
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA157.bat
                                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5480
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA212.bat
                                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:4936
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:4516
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2BE.bat
                                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:6136
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1604
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA35A.bat
                                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:2556
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:3820
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3F7.bat
                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1584
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA55E.bat
                                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA629.bat
                                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA85C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA927.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:552
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC05.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE38.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB07A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB116.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB25E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB31A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB452.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB58B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB617.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB76F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB953.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC90.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD4B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF01.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC049.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC172.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC366.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC460.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC579.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC682.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC78C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC819.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC886.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC903.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9AF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA1C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA99.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB16.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBB3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3092
                                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                          29⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                          PID:3948
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                            30⤵
                                                                                                                                                                                                                                                              PID:3760
                                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                      PID:4968
                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                        PID:1664
                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:1712
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 944
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 944
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                          PID:4612
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4968 -ip 4968
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:5908
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4968 -ip 4968
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:1108

                                                                                                                                                                                                        Network

                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                              $$a2F34.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a2F34.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 243f73bf8e2825c32eff11e470f401edf5f086b23830c2da4c95b42de4f11065
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a3445.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3445.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 1bb96f62c4ab3e5c066251d64b35b2c093679eebc95f66d58e4fc5e033a86d6a
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a36E5.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a36E5.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 4cd1dfbb0e2eb3f862d62df47024f26599b602ec8e48df4d70de7060dd369b6d
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a3AAE.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3AAE.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 0eb10531b35295992d066a0e393c9bee1eb029c9cec32991cb9fcf4e9c2a6b8f
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a3CE0.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3CE0.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 80ca99a03e04b14006e4c4b70743cbc46ac391791d30fab9a4aa55a3aa159d48
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a3F51.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3F51.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 ae4d98cd7982fb19023280828f85117e877fd79cf589490852aa8b02426d54e5
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a41D2.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a41D2.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 8c2d758640a7bdcabe5723e15ef6a15935f08c1ce7e8d150f9196145710336c1
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a4462.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4462.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 3ef8acd5d78a4eed06e5778e3fa9c5533a0b2e30485ef74c7d3515e934243cbb
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a4963.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4963.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 177192dfc4631331d1b79c89e6dc2d409e8cfbd63d07a6a4b199bee3dbecd44c
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a521E.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a521E.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 10e95373cb01b9b18c10c1a22a2c362263cbe2e8015a6a84f76eaec8a7623806
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a56A2.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a56A2.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 8711c840bfd135ff3caf4defd48817d8742d4c55f70ce6fbcfa5a200c6fc809b
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a5CCC.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5CCC.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 4817fda7565e184a073423b0932042e66f6e177b77d0d2f9db74447f6ff2dde8
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a6075.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6075.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 8cf34ce4c1ed89ead4515494a3bb2bb5bc9e97585b51fdda41b985041be69bf7
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a63F0.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a63F0.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 50c06d0e6a52b9429724427b2edcaa9757a98c7ac33b87c61d3791a622fb911b
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a66AF.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a66AF.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 3729abd41fa67bc52691fc177de0740046e5f60eead2d575c52606c41f7f3753
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a6911.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6911.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 5688abfe11704c1afdc26a136609a3fe73da695d26570d40605aea1deb50abe5
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a6BA1.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6BA1.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 8206e8501f8389bb962badf8e21eff456f308edc25c368e94947a037ed82000f
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              $$a6DD3.bat
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6DD3.bat
                                                                                                                                                                                                              • Size 776B
                                                                                                                                                                                                              • SHA256 79cd3b5720e5a7e4405f78aa2665f597c657e61bf8a5a76986d6387a2041913b
                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.9MB
                                                                                                                                                                                                              • SHA256 8a06619c5522f69e4a5b35b9c0aa2f8007076e335ec6d2b427603d2cac7167eb
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.8MB
                                                                                                                                                                                                              • SHA256 b091ac58f75e501f2e2b90abcf727d66226e1f0b8d15c5cd2f9c27c952576590
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.7MB
                                                                                                                                                                                                              • SHA256 5fb856a7fd4835cdf53a1ca9c66dfb08a9ecc37475889156f5b316c46c95b3ff
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 5.0MB
                                                                                                                                                                                                              • SHA256 093de2cd0f0c0200c0f33f0e43c8b88d96bac5493744c30141130291e53fe795
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.7MB
                                                                                                                                                                                                              • SHA256 23feeb64131b36557e24be6a4b1419bc7e293fca38fd7e2d25f7e77ff338e585
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.9MB
                                                                                                                                                                                                              • SHA256 f6006b6edfa6802c0f1e5f7036a752f5d1c895f05d6a4d7627d0d42267ba72a8
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.6MB
                                                                                                                                                                                                              • SHA256 d879d62934266cc2849dd176575713db48e9ee3939a247b19257e3d9c432784f
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.6MB
                                                                                                                                                                                                              • SHA256 3786ed457815bd6f9af3a8932a5ac58bfebb8b5544e270851a73dfcc0873beae
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.9MB
                                                                                                                                                                                                              • SHA256 8e62c855998a4672c25dc36f8ab463aabc10d2ab029727e2bf0910ff2ca43365
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.6MB
                                                                                                                                                                                                              • SHA256 39131283660397c37b149840a9e9d88630f138947bc6a428e3c701a47a7cc2ed
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.5MB
                                                                                                                                                                                                              • SHA256 34eb717a6d78f95ade337a622c84afd75a8b543a800ac56f1b6720a4e4df848c
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.7MB
                                                                                                                                                                                                              • SHA256 9ebed0650900172bc35a358851b98fad63a7b18a2ace91a3dafdedb1edf90256
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.8MB
                                                                                                                                                                                                              • SHA256 fde89b8ec77aecebf75440d4d5736458a3e495d3589603e1e89e776f94195133
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.8MB
                                                                                                                                                                                                              • SHA256 2b69092514362948deeefaad180e253c47705e4fc898b2d8de68da99ba844171
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.5MB
                                                                                                                                                                                                              • SHA256 2a0251aaa1adf56e66b105dda9fced24094a2e8b0e4dfaca5aa6542d01688647
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.5MB
                                                                                                                                                                                                              • SHA256 70ebc12510d1aa7bebb2f76a1ec9daf3ebc7516215c37736ca23a87aafbe42a6
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.4MB
                                                                                                                                                                                                              • SHA256 89281a8d0742d351c073bfea82e895ded27568b528bb180d5814ed7f55e955f4
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_779dbacc6993a9c5e533723a5104edd6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                              • Size 4.4MB
                                                                                                                                                                                                              • SHA256 85d76a5dc45a35513eeb109046e74defffaf8c1164869cdd1f63fd7c14c12da0
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              Dll.dll
                                                                                                                                                                                                              • Path C:\Windows\Dll.dll
                                                                                                                                                                                                              • Size 68KB
                                                                                                                                                                                                              • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              Logo1_.exe
                                                                                                                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              _desktop.ini
                                                                                                                                                                                                              • Path F:\$RECYCLE.BIN\S-1-5-21-3611646547-550105268-947503007-1000\_desktop.ini
                                                                                                                                                                                                              • Size 9B
                                                                                                                                                                                                              • SHA256 2ef572b16408784c924887853b6865cbb5f2ade2f877f17ee91c4af1bf1cff51
                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                              memory/200-3685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/248-3571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/268-3728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/268-3722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/552-3402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/580-3721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/624-3023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/688-3541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/784-3134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/796-3577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/824-3438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1000-3517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1036-3372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1068-3215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1136-3547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1176-3264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1192-3074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1232-3643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1248-3649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1260-3378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1308-3144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1324-3089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1328-3033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1380-3691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1404-3607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1420-3505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1448-3619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1548-3165-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1552-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1592-3225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1604-3336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1800-3703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1876-3312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1928-3697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1992-3709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2092-3553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2120-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2292-3673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2320-3252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2456-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2608-3631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2640-3230-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2720-3300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2764-3270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2784-3637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2852-3432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2860-3180-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2928-3170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2932-3288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2964-3523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3084-3667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3088-3408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3112-3154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3116-3559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3124-2997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3172-2962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3180-3159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3216-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3268-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3284-3481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3288-3054-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3316-3240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3436-3715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3592-3185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3648-3450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3724-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3732-3258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3760-3601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3768-3565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3804-3589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3808-3294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3812-3462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3820-3342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3836-3049-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3856-3529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3900-3235-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3924-3043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3980-3084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4084-3354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4136-3079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4164-3109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4180-3595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4216-3038-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4260-3114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4340-3469-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4428-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4440-3069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4452-2987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4516-3330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4520-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4520-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4528-3205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4536-3348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4548-3475-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4560-3015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4588-3613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4620-3220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4624-2979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4632-3276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4676-3360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4752-3104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4800-3420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4832-3679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4836-3625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4840-3414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4864-3044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4864-3160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4892-3246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4948-25-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4952-3190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4968-405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4968-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4968-2965-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4968-2534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5000-3124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5080-2954-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5220-3210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5304-3499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5332-3007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5336-3200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5344-2533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5364-3059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5368-3390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5408-3511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5424-3094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5464-3149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5480-3324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5500-3306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5504-3099-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5536-3384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5652-3444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5660-3456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5664-3139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5680-3661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5684-3028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5688-3655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5704-3195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5780-3175-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5800-3129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5816-3282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5844-3119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5852-3064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5872-3366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5936-3583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5988-3493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5996-3426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/6020-3318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/6024-3535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/6032-3487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/6096-3396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/6128-460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                              Download