Overview

overview

7

Static

static

3

2025-07-02...op.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2025, 04:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
  • Size 5.1MB
  • Sample250702-e1f8qshj8x
  • SHA256 d8c415440993481136aba96034c8589f78afbaca85a0b7fd6596d4ea0f7ec792
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3432
      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4824
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a467F.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4596
          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2228
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4805.bat
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:768
              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3768
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49EA.bat
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4328
                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2156
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BCE.bat
                      9⤵
                      • Suspicious use of WriteProcessMemory
                      PID:640
                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                        10⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:376
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DD2.bat
                          11⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4532
                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                            12⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1536
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FB6.bat
                              13⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4952
                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                14⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:860
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51F8.bat
                                  15⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3080
                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                    16⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2200
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5340.bat
                                      17⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4588
                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                        18⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:1844
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5515.bat
                                          19⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:2884
                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                            20⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            PID:4008
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a564E.bat
                                              21⤵
                                                PID:3620
                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                  22⤵
                                                  • Executes dropped EXE
                                                  PID:392
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57B5.bat
                                                    23⤵
                                                      PID:4140
                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                        24⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3696
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58ED.bat
                                                          25⤵
                                                            PID:2192
                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                              26⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1952
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A45.bat
                                                                27⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3200
                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                  28⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:3520
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BDB.bat
                                                                    29⤵
                                                                      PID:1316
                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                        30⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        PID:1372
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DC0.bat
                                                                          31⤵
                                                                            PID:2120
                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                              32⤵
                                                                              • Executes dropped EXE
                                                                              PID:3400
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6002.bat
                                                                                33⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3456
                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                  34⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:4828
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a615A.bat
                                                                                    35⤵
                                                                                      PID:2936
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                        36⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        PID:4972
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a632E.bat
                                                                                          37⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5008
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                            38⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            PID:4048
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6467.bat
                                                                                              39⤵
                                                                                                PID:4884
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                  40⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5080
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a667A.bat
                                                                                                    41⤵
                                                                                                      PID:1580
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                        42⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:4056
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6997.bat
                                                                                                          43⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:1336
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                            44⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            PID:512
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B2D.bat
                                                                                                              45⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:4736
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                46⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:2428
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BF8.bat
                                                                                                                  47⤵
                                                                                                                    PID:1932
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                      48⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:3332
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CB4.bat
                                                                                                                        49⤵
                                                                                                                          PID:1796
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            50⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:4940
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D60.bat
                                                                                                                              51⤵
                                                                                                                                PID:5048
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  52⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:2896
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E1B.bat
                                                                                                                                    53⤵
                                                                                                                                      PID:3752
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        54⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:4912
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F25.bat
                                                                                                                                          55⤵
                                                                                                                                            PID:3932
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              56⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:1544
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FA2.bat
                                                                                                                                                57⤵
                                                                                                                                                  PID:1836
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    58⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:2240
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7129.bat
                                                                                                                                                      59⤵
                                                                                                                                                        PID:4624
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          60⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:4008
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7186.bat
                                                                                                                                                            61⤵
                                                                                                                                                              PID:1268
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                62⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4608
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7203.bat
                                                                                                                                                                  63⤵
                                                                                                                                                                    PID:804
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                      64⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:3392
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7261.bat
                                                                                                                                                                        65⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:220
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          66⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:4140
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72BF.bat
                                                                                                                                                                            67⤵
                                                                                                                                                                              PID:3100
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                68⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:4448
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a733C.bat
                                                                                                                                                                                  69⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:3528
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    70⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:3168
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73E8.bat
                                                                                                                                                                                      71⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4356
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        72⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:2120
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74A3.bat
                                                                                                                                                                                          73⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:3200
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            74⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:3508
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a754F.bat
                                                                                                                                                                                              75⤵
                                                                                                                                                                                                PID:1956
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a760B.bat
                                                                                                                                                                                                    77⤵
                                                                                                                                                                                                      PID:1836
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:3156
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77A1.bat
                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4996
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:5048
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a788B.bat
                                                                                                                                                                                                              81⤵
                                                                                                                                                                                                                PID:4244
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:2788
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7937.bat
                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:4396
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:4372
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79D3.bat
                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                          PID:1056
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:3488
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A7F.bat
                                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:2288
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B2B.bat
                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                      PID:1820
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:5020
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BF6.bat
                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                            PID:2292
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:2492
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CA2.bat
                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                  PID:3452
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:1708
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a800D.bat
                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                        PID:2548
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80A9.bat
                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:3380
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:1580
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8107.bat
                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                  PID:4048
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:3056
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8165.bat
                                                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                                                        PID:4780
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:4792
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81D2.bat
                                                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1816
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:4412
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8220.bat
                                                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                                                  PID:1636
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                      PID:376
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a826E.bat
                                                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                                                          PID:3752
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:3156
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82DC.bat
                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                PID:4624
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  PID:932
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a833A.bat
                                                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                                                      PID:3768
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:372
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8397.bat
                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:1756
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:1452
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83F5.bat
                                                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                                                                PID:3656
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:1056
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8453.bat
                                                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                                                      PID:2900
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        PID:1144
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8647.bat
                                                                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                                                                            PID:4724
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                              PID:3380
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86F3.bat
                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:4412
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:4804
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a877F.bat
                                                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                                                      PID:4512
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:4224
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87CD.bat
                                                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                                                            PID:4900
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:4064
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a882B.bat
                                                                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2788
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    PID:2420
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8879.bat
                                                                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1036
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                          PID:3676
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88F6.bat
                                                                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                                                                              PID:432
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:644
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8954.bat
                                                                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:540
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:2208
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A2F.bat
                                                                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:5032
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4056
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8ABB.bat
                                                                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2628
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:2900
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B29.bat
                                                                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4204
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:4608
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B77.bat
                                                                                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:1056
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:2192
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BD5.bat
                                                                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C23.bat
                                                                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C71.bat
                                                                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:220
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CBF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D1D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1372
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E17.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E75.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8ED2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a926C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9357.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9402.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B65.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D0B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D59.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DA7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E05.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E63.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EB1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EFF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FAB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA047.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA103.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA151.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA20C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA26A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA316.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA364.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA41F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA47D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA529.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA613.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA662.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA76B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA856.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA911.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA96F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA98.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB53.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABFF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACBB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE51.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4784
                                                                                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                        PID:2604
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                          PID:3524
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:3680

                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                          $$a467F.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a467F.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 7f66acad767bc7730e56682df8639ceb859ea153558b7383c927683adf3ff6e0
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a4805.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4805.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 0dbce69ce8389f59f3855668329c1cbf6223a477757724f26eaf3d5ef9f1d346
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a49EA.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a49EA.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 c19135ad7d7639e50b153afdea85587c2851e267663b7ea591f28430a1c9b22c
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a4BCE.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4BCE.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 76d01dad6a05db1fd0a24c92cc8c0c2581d8872d8af455a472637f82719e445c
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a4DD2.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4DD2.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 3d4270cb9b8100a2a668b3d88008c87cc848b9b1a85291d2fc6ef3442a3c2cfd
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a4FB6.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4FB6.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 49dd1e73ffd9bddfc2f197e9728a389dfb391c43be391508d9dffb58e1187646
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a51F8.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a51F8.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 0ad42b7015cd0bde4d14e4a06f280e0a0d3118ae3c928bae414ccf70f2030580
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a5340.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5340.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 7dd089e62f16327633630c711cab080c06c2e4dc2662dc8b7016fb95f9e083c4
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a5515.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5515.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 7c8a5951155d6053ed71294aff42425d33f728590619900874ca1a15ab571141
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a564E.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a564E.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 c49b903916b5c206c443dae701c6d3408c76ac626265811561cb55f667074a59
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a57B5.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a57B5.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 b3490064a899f775b81fb24243bffa7661fd2bf7364d91ba2b86311a698d6f5a
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a58ED.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a58ED.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 5bd094df2ac33d4026335fe17067f25ea3e8cc299e005317dc636fb3d1a71a69
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a5A45.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5A45.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 3be280c4185d5e8a76cb997d67bee7824ef4082560f36685db6820600aca574c
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a5BDB.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5BDB.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 1ddfb7ac53c9f53a9f151bbd14684e5c5d16fb573df007d58001aeac4b1da317
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a5DC0.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5DC0.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 dfe3c4e939a6fd8d047fb96489df46ff1ba24968271b056d0b4c4529097fa12f
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a6002.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6002.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 c5c76b895fb9cb045c73eb3fdf7691a1a4fd59e83804fe8673bd52afb8367f21
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a615A.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a615A.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 d4cf78804475c2f4ba7734a1f00580f856319610828d2029ccc5c9ad88512dd0
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a632E.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a632E.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 1c6c870d999ffcb4bb1b4994a582fb69dfc318f5961f3ffa259a38e426593bd7
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a6467.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6467.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 b1556f081bc57ceacdaf1e19c4e9a605053c4f04940c0e781975b7e0658efae6
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a667A.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a667A.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 a9132b0acc46b8cb47cdba3d3b1c5cd0535a6b43ae2d8346801a328c04c39766
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          $$a6997.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6997.bat
                                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                                          • SHA256 2057e20facb6aa41595c06b471df75cb0972934f20c0f5026b98be6aa995b93e
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 5.0MB
                                                                                                                                                                                                                                                                                                          • SHA256 e657a432aa54bfe93259ebfbd34dc4a3712133e5c134bc722f587db3e5dfa90c
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.8MB
                                                                                                                                                                                                                                                                                                          • SHA256 617670ea14a1bee928e35179461e621a748733ae54579f10e7fa9476746fe819
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.6MB
                                                                                                                                                                                                                                                                                                          • SHA256 17196f1d59a8887168f8432d86aaa12402279bb74f42616297dfd99a2fcfab27
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.9MB
                                                                                                                                                                                                                                                                                                          • SHA256 cefcefd4b76c6057c5e4adbfa53e2e77de8ba4fe00549ce7a5952f7eff005973
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.7MB
                                                                                                                                                                                                                                                                                                          • SHA256 76ffa186c33c1a6887f0d53c4e9a5b1b2d7ad35ad8018492351025c9fbf23b75
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.7MB
                                                                                                                                                                                                                                                                                                          • SHA256 b8f468666866e9d358805677b7171aa8a9c2264e9c462792f766a7a89b98bb0f
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.5MB
                                                                                                                                                                                                                                                                                                          • SHA256 82b31e925493980542d8500ebc4efa6f53c1c7121b98b59c68ef711b44f4e057
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.9MB
                                                                                                                                                                                                                                                                                                          • SHA256 af1a9b4dc1a0603cb8d82465cda62e9e8e5776fc12dccdef442adcc8af7af8fb
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.8MB
                                                                                                                                                                                                                                                                                                          • SHA256 8d20121f552f45e4ccbcb8e82f17702d491281556116f4733e3cb041643fb6ae
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.7MB
                                                                                                                                                                                                                                                                                                          • SHA256 e82dc11db5e368f864214a1c1632b8bec256a3e6e9251ade10bb2acb15f83a9c
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.6MB
                                                                                                                                                                                                                                                                                                          • SHA256 eaa296f7df6b8458bdbcc57f8d3ff9156b2685276c9a39f57ac895f5654edb7f
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.5MB
                                                                                                                                                                                                                                                                                                          • SHA256 6635ae34d3354d39ca844b4962a284ff2f178f764f3fc8f8907c59692c996f00
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.9MB
                                                                                                                                                                                                                                                                                                          • SHA256 03c0cf3ded5f31db8c4074f7a6ccb1362470c63ce6438977c7bb95f106190d0d
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.8MB
                                                                                                                                                                                                                                                                                                          • SHA256 3f45a0a5154d3d23c64942ea6890a306f3308a95fcd806074a10aeef18570af2
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.6MB
                                                                                                                                                                                                                                                                                                          • SHA256 497ba926c05ef9a7c2816b930ccec8a2a48f675fb727c8ce257673d378a55ebb
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 5.0MB
                                                                                                                                                                                                                                                                                                          • SHA256 87b6f408ad747c36db6b2afb0b4ce6104f06651f8163d28d4b1ba49a154570d5
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.5MB
                                                                                                                                                                                                                                                                                                          • SHA256 bdb5725bc4666ed43ca0392f8f18c9991fd19f4bce5a4bb9097f0021db72ab7e
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 5.0MB
                                                                                                                                                                                                                                                                                                          • SHA256 2c194cd8f3088f9ef0faac63b774dbd3f336e2386fd634097513bd933140447f
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 4.4MB
                                                                                                                                                                                                                                                                                                          • SHA256 548ba6fc2b1205acea73832c765df974befadadb2c07e3916ce362b3b1e30088
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2025-07-02_0f2e172a3f2f24fb54b96687f9af5e51_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                          • Size 5.0MB
                                                                                                                                                                                                                                                                                                          • SHA256 89052f94feab5419b6c99f995f0ad766d77f0efd6cbf1d75c44d6cead712f28c
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          Logo1_.exe
                                                                                                                                                                                                                                                                                                          • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                                                                                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          _desktop.ini
                                                                                                                                                                                                                                                                                                          • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                                                                                                          • Size 8B
                                                                                                                                                                                                                                                                                                          • SHA256 7ee98acf971e32cae894381122352197a76e04e7689903e61cef63ad4f690736
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          memory/8-10233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/8-7533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/220-6338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/228-10318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/372-5751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/376-44-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/376-5739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/392-97-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/512-726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/644-6294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/672-10143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/672-7718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/736-10183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/740-10268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/804-10223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/860-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/908-10088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/932-5747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/932-10273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1036-10093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1056-10213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1056-5759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1144-5996-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1316-10228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1336-6373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1372-129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1372-6348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1448-10308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1452-5755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1536-8827-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1536-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1544-1943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1580-6353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1580-5726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1644-10263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1692-10158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1708-5616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1816-6368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1844-82-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1884-10278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/1952-113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2016-9431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2036-6343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2052-10063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2100-10238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2120-2341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2136-10148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2156-36-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2188-10258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2188-7128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2192-6323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2200-71-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2208-6299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2228-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2240-1947-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2288-3749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2324-8079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2420-6284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2428-920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2492-4129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2508-10293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2588-9060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2604-1481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2604-93-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2604-8-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2612-10333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2776-10108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2788-5722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2788-3292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2828-2701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2836-10138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2896-6328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2896-1559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2900-6309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2900-10123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2920-10118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3028-10328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3056-5730-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3156-2877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3156-5743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3168-2139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3224-10253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3276-10243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3332-1110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3380-6164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3392-1959-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3396-10313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3400-136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3424-10128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3488-3566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3492-10173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3508-2513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3520-120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3552-10203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3676-6289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3688-10098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3696-106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3768-27-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/3832-6333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4008-89-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4008-1951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4020-10193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4032-10288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4036-10178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4048-159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4056-486-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4056-6304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4064-6280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4120-10218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4136-10083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4140-1963-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4176-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4224-6276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4268-10068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4300-10188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4364-10298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4372-3417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4380-10198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4412-5735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4448-2001-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4456-8256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4468-10208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4588-10323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4596-10283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4608-1955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4608-6318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4636-10078-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4668-10339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4668-10334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4672-10073-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4736-10133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4792-5734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4796-10163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4804-10153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4804-6272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4824-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4824-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4828-143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4868-6363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4912-1939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4940-1294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4972-152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/5016-10303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/5020-3949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/5032-10113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/5044-10168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/5048-3126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/5076-6358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/5080-166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/5088-10248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/5108-10103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download