Overview

overview

7

Static

static

3

2026-11-01...op.exe

windows10-2004-x64

7

2026-11-01...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 04:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
  • Size 2.8MB
  • Sample261102-elxbeaea67
  • SHA256 53be9ee04cd96137493fd25f3eec523fddeb5ef71449fd94641bac793d1288e7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5684
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4358.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4944
      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4608.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1988
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47AE.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4884
              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3200
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48E6.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1232
                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2292
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B96.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3020
                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:5392
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C90.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5796
                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:6036
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DD8.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4476
                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:1824
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F30.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2064
                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:5736
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5058.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:1188
                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:3340
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51B0.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:5936
                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:4876
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5327.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:1968
                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:964
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a549E.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2320
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2312
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55F6.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2140
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5348
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a570F.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2092
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5332
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58C5.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5256
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2832
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D1A.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3044
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4872
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6112.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:6084
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2424
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6279.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3672
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1436
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63C1.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2168
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3728
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6519.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5464
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3108
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a698E.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1604
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1856
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7380.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3636
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3168
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a745B.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1168
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4480
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7555.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1732
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4868
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7630.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1892
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5088
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76DC.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1388
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2088
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A56.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2880
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2044
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B02.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5792
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4512
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BBE.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4212
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1992
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C79.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:5396
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4408
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D44.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:3256
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:2472
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E2F.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4796
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4676
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EEA.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1784
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:5964
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80AF.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:5144
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2908
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a813C.bat
                                                                                                                                              70⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5712
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:4636
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81D8.bat
                                                                                                                                                  72⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5616
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:3712
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87B4.bat
                                                                                                                                                      74⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:1140
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        75⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:680
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8870.bat
                                                                                                                                                          76⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:2260
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            77⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:5932
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88FC.bat
                                                                                                                                                              78⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:3692
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                79⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3224
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89B8.bat
                                                                                                                                                                  80⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:4528
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    81⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:1696
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A35.bat
                                                                                                                                                                      82⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:5380
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        83⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:3808
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AF0.bat
                                                                                                                                                                          84⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:2488
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            85⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:5580
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B7D.bat
                                                                                                                                                                              86⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4516
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                87⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:1376
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C0A.bat
                                                                                                                                                                                  88⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:5028
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    89⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:6072
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CA6.bat
                                                                                                                                                                                      90⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:5628
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        91⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:260
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D23.bat
                                                                                                                                                                                          92⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:3324
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            93⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:2556
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DA0.bat
                                                                                                                                                                                              94⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:5300
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                95⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5092
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E4C.bat
                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:4084
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:1428
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EF8.bat
                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                        PID:2560
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:368
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F84.bat
                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                              PID:1160
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:1744
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9011.bat
                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:4308
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90AD.bat
                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:2388
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:604
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9149.bat
                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:764
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4560
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9205.bat
                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3652
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:2228
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9282.bat
                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:3220
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:5600
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a930F.bat
                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:4956
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:1380
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a938C.bat
                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:6000
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:5064
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9437.bat
                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:4520
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:2620
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94B4.bat
                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:1808
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:2984
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9541.bat
                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:3696
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2440
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95CE.bat
                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:1512
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:204
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a964B.bat
                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:5884
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:4696
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96B8.bat
                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                    PID:5640
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4332
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9745.bat
                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:1720
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:3940
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97C2.bat
                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:5296
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:5312
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a985E.bat
                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                  PID:2940
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:2496
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98EB.bat
                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:4968
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:4800
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9977.bat
                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:4708
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:5608
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A23.bat
                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:3236
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:4348
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ABF.bat
                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:1096
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:2756
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B3C.bat
                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:2708
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:4240
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BB9.bat
                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:4368
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:4552
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C27.bat
                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:5128
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:4160
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CA4.bat
                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                    PID:5008
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                        PID:2288
                • C:\Windows\Logo1_.exe
                  C:\Windows\Logo1_.exe
                  2⤵
                  • Creates a file in the Startup directory
                  • Executes dropped EXE
                  • Enumerates connected drives
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • Reads the TCP/IP host and domain name from the registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:5756
                  • C:\Windows\SysWOW64\net.exe
                    net stop "Kingsoft AntiVirus Service"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1600
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                      4⤵
                        PID:2624

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      Windows Command Shell

                      1
                      T1059.003

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Defense Evasion

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Peripheral Device Discovery

                      1
                      T1120

                      Query Registry

                      1
                      T1012

                      System Information Discovery

                      1
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      $$a4358.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4358.bat
                      • Size 776B
                      • SHA256 f63c0aef4a8e0cb815627be05aa77bb824b92b4f822a48d4b151687b2596f36e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a4608.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4608.bat
                      • Size 776B
                      • SHA256 db2808bb0fe614df496ca71917426fb49d724f14c67f030693f3f5fb7c5c08a5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a47AE.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a47AE.bat
                      • Size 776B
                      • SHA256 a2599271998127a2ac0bdebd533a063dd63e2470b27d006be105a5e30fefe570
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a48E6.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a48E6.bat
                      • Size 776B
                      • SHA256 eb3ec5221ff8177ccb43e89c161d456eeebf09a8a792b9d6170cde8187c22779
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a4B96.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4B96.bat
                      • Size 776B
                      • SHA256 0b56dea861d925dc74f08605aafa7ad5c6a37c1bdde4b0a50d78dbf30f5e3e27
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a4C90.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4C90.bat
                      • Size 776B
                      • SHA256 61ef101dfaa4febcac1af9368574bf0fc74fee97c5a1942b292846bd9e415ccd
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a4DD8.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4DD8.bat
                      • Size 776B
                      • SHA256 fd16109e609d1982d8abf40e3d779d26eb56773e19c6e71114ffa52740697565
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a4F30.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4F30.bat
                      • Size 776B
                      • SHA256 3f057247aa92200dbe3dcf62c31a2e173a8bf03adb1aa2df0eb4d187499f60a8
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a5058.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5058.bat
                      • Size 776B
                      • SHA256 d162c5e1a3ed8ea87802e0c0c050f2b1e64d402d0453759281d8056aceb2679e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a51B0.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a51B0.bat
                      • Size 776B
                      • SHA256 c31b53b34cdaf0f56bc0f99ccdc3e1763c9a899eb47fdcc3b0747b0e6fdca938
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a5327.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5327.bat
                      • Size 776B
                      • SHA256 fd2b47e5e05f55cf184031b4a8e128893515b7a105ef67802192fd08b00b3ca8
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a549E.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a549E.bat
                      • Size 776B
                      • SHA256 397841b3da6cbaf7c6730f2a47c36923c10b665558ccf91e6224ccc915e176d2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a55F6.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a55F6.bat
                      • Size 776B
                      • SHA256 d2715e87057c745518ce655414a6f409f6fdc5fcbc06ce4c0bed74acebb07973
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a570F.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a570F.bat
                      • Size 776B
                      • SHA256 26c046a85a91286a360227a57e35cfe1c1710319f8ca7582bbcd08c958f4e87b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a58C5.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a58C5.bat
                      • Size 776B
                      • SHA256 699bab40b53858e346cd4a3805a247586fb5c6279c5d6f256adfeb3c70e27344
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a5D1A.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5D1A.bat
                      • Size 776B
                      • SHA256 8d1a178d97a0ab5f5e92266309194b85dd91326eec1823af3117c24b0e5d20ab
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a6112.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6112.bat
                      • Size 776B
                      • SHA256 607539bae77904f5950d5da4872dedfd5e9894299ad476deec1b66859baef43c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a6279.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6279.bat
                      • Size 776B
                      • SHA256 9698003a02dd11f457e29d37549e7225472710c7df32b6314e2efb43bc73b00f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a63C1.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a63C1.bat
                      • Size 776B
                      • SHA256 34e1e81e1f4ff2781243b3b2a9c80269fe3ac70eb702aa72596cccf5db7b37d0
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a6519.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6519.bat
                      • Size 776B
                      • SHA256 7a42fa4581e5c7a3d40b37f8c03a8d476efe7849f1d678cd05eccbf24569d8a1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      $$a698E.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\$$a698E.bat
                      • Size 776B
                      • SHA256 39427d7dc93f0b6065ada715bbd6d4766e2623bc6d760b3a8ac8288c595372b1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.1MB
                      • SHA256 8d0235cb167a63bbcf50335c7b498985311c395d84d6fb70edea585d8ee0484b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.3MB
                      • SHA256 544f611fa023f2edd0c0612539d5b1c66f3a3b044c174020e48437208e5dd2ee
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.5MB
                      • SHA256 3462466e6c76d3a285bd2e4ea3b0d915beaeb1021cf51fe39d3fbbf7b4a11906
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.3MB
                      • SHA256 86f5eff4646ababeb42d7b56d5611bf90477db52486543ddeb76ea92a31e32b7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.2MB
                      • SHA256 cd43087991e95b7fc3d94f76bce7ca055753c9164196d3a55a646e63fc95cf93
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.7MB
                      • SHA256 3dc25f84091422a751a3772a26633b391eaa245e8d870c7bf2477c73b87ea300
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.7MB
                      • SHA256 0b55c06709f3f46f8d96136f7167e258eff79a5d5a510d7bc833c970da86a9cd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.4MB
                      • SHA256 86871ec0e4694cbdcf96008bce6d030be66cf1e97d0beaf2c81d8b52486426f5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.2MB
                      • SHA256 0bdea4fbbce1a53c943ee2ea63b1a952b9f082f220eae2a298feea7662f3d89a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.7MB
                      • SHA256 7a92627f23565c5c6d025c2b5556b4748e0bc416a67873079655b22db832cfc5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.6MB
                      • SHA256 748c4abcaeed0a2d4a6f80bff12c7ceb1bc309c90013ba7282572b26993e7d14
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.4MB
                      • SHA256 d153e8352566d17ca657d66a238071d614cfbfe7c37baee7b5d157fbd5225508
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.2MB
                      • SHA256 827ec0ac02b2bb16ebce79a89f02efaa883076d7730b77bee2abdfb2f8827807
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.6MB
                      • SHA256 4de9746f2b4feeb52f3be4ce5f183bf916270e809d356874908876b750812168
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.6MB
                      • SHA256 cc2989a137fc1c700e8f5000c68ac22f159f9f559e1b0f1df600f3daafdc4f3c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.5MB
                      • SHA256 e4fc52ef976cd458f233bdb3a43f7b0c65cb8d054b579bc9a0c11e2c317de7f8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.5MB
                      • SHA256 6b56252728656bfbdf110e90b55baef50c78a87e5f1a1cabd22ed74497e6d99d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.5MB
                      • SHA256 48ea9feaf86e916de5283d37a72ee0cb08da1a84abff2c17e6eb9c7a5f234899
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.4MB
                      • SHA256 f220d409725ae883ed877c23db891514385483e4307f87d731a3f9c73d38ac43
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_edbcd364f3f053be7d0b1bec0ac0b38b_amadey_elex_smoke-loader_stop.exe.exe
                      • Size 2.3MB
                      • SHA256 a550a3c0f8ca306e7d5f13bc3cdb9f0e377744e21062a59b8d577c9a11a0587f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _desktop.ini
                      • Path C:\Users\Admin\Downloads\_desktop.ini
                      • Size 9B
                      • SHA256 0af15a3ce4f4d2fbbfae5716a07dfabaa2abd7fa0ea35841b3beb25101cf56b2
                      • MD5 SHA1 SHA512
                      Submit Download

                      Logo1_.exe
                      • Path C:\Windows\Logo1_.exe
                      • Size 32KB
                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _desktop.ini
                      • Path F:\$RECYCLE.BIN\_desktop.ini
                      • Size 9B
                      • SHA256 0af15a3ce4f4d2fbbfae5716a07dfabaa2abd7fa0ea35841b3beb25101cf56b2
                      • MD5 SHA1 SHA512
                      Submit Download

                      memory/204-8377-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/260-8280-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/368-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/604-8322-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/680-8230-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/964-130-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/1376-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/1380-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/1428-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/1436-1949-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/1696-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/1744-8310-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/1824-1924-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/1824-87-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/1856-5676-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/1988-33-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/1992-6185-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2044-6173-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2088-6167-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2228-8335-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2292-54-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2312-139-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2424-1939-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2440-8371-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2472-6201-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2496-8411-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2556-8286-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2620-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2756-8439-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2832-1157-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2908-6219-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/2984-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/3108-2936-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/3168-5682-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/3200-44-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/3224-8242-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/3340-109-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/3712-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/3728-2024-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/3808-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/3940-8397-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4160-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4160-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4240-8446-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4332-8390-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4348-8432-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4408-6191-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4480-5688-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4512-6179-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4552-8453-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4560-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4636-6903-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4676-6207-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4696-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4800-8418-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4868-5694-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4872-1930-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4876-119-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4876-1944-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/4964-24-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5064-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5088-5700-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5092-8292-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5312-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5332-212-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5348-148-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5392-69-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5580-8262-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5600-8341-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5608-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5684-13-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5684-0-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5736-100-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5756-3933-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5756-10-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5756-114-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5756-8324-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5932-8236-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5960-8316-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/5964-6213-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/6036-78-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download

                      memory/6072-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                      Download