Overview

overview

7

Static

static

3

2026-09-08...op.exe

windows10-2004-x64

7

2026-09-08...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 06:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
  • Size 6.9MB
  • Sample260910-grxv8syhpb
  • SHA256 54b28df1d95f02bb91d5c21aad0b0c2d5c544573afe14ca59f5b822dc19621c5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2FA.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4960
      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1716
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6A4.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4460
          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1992
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB47.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3800
              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1996
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF2F.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5932
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1840
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC27B.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5052
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:1580
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC625.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1192
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4816
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA8A.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1628
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3000
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2D7.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4432
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:5868
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD603.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2740
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:576
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE90E.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3492
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:1428
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB7F.bat
                                              22⤵
                                                PID:5928
                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                  23⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2520
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF12C.bat
                                                    24⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3528
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                      25⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5584
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF582.bat
                                                        26⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5632
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Windows directory
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1488
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDEE.bat
                                                            28⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5428
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                              29⤵
                                                              • Executes dropped EXE
                                                              • Drops file in Windows directory
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3036
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A1.bat
                                                                30⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5712
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                  31⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4596
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63B.bat
                                                                    32⤵
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1540
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                      33⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3664
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a987.bat
                                                                        34⤵
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1204
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                          35⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1528
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE2.bat
                                                                            36⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1020
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                              37⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1520
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a109B.bat
                                                                                38⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2816
                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                  39⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4172
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13C8.bat
                                                                                    40⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:720
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                      41⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4728
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17CF.bat
                                                                                        42⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2240
                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                          43⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2028
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AAD.bat
                                                                                            44⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3956
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                              45⤵
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in Windows directory
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2792
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C15.bat
                                                                                                46⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2756
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                  47⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4168
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CFF.bat
                                                                                                    48⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5696
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                      49⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4376
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E47.bat
                                                                                                        50⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5104
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                          51⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in Windows directory
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5796
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F12.bat
                                                                                                            52⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5168
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                              53⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4300
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a200C.bat
                                                                                                                54⤵
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3276
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                  55⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5572
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2106.bat
                                                                                                                    56⤵
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1496
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                      57⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2300
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2220.bat
                                                                                                                        58⤵
                                                                                                                        • Executes a command shell one-liner
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4608
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                          59⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4636
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22EB.bat
                                                                                                                            60⤵
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3888
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:1632
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23B6.bat
                                                                                                                                62⤵
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:2528
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:2700
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24A0.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:5836
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:2012
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a257B.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:5040
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1904
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2665.bat
                                                                                                                                                68⤵
                                                                                                                                                  PID:764
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    69⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:3444
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a276F.bat
                                                                                                                                                      70⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:5892
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:940
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2879.bat
                                                                                                                                                          72⤵
                                                                                                                                                            PID:704
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              73⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1484
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2963.bat
                                                                                                                                                                74⤵
                                                                                                                                                                  PID:3716
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    75⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:5280
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A2E.bat
                                                                                                                                                                      76⤵
                                                                                                                                                                        PID:1060
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          77⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:5720
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B18.bat
                                                                                                                                                                            78⤵
                                                                                                                                                                              PID:2604
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                79⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:3392
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C03.bat
                                                                                                                                                                                  80⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:4832
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    81⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:2184
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CDE.bat
                                                                                                                                                                                      82⤵
                                                                                                                                                                                        PID:2796
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          83⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:4112
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DD8.bat
                                                                                                                                                                                            84⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:5044
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              85⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:4496
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EC2.bat
                                                                                                                                                                                                86⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:564
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3880
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F9D.bat
                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                      PID:6092
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:6068
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3077.bat
                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:2112
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:2296
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3171.bat
                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4716
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:4516
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a323D.bat
                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:632
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:2820
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3327.bat
                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:4072
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:1420
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3421.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                            PID:4864
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:4904
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a351B.bat
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                  PID:2344
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:4628
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35E6.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:1352
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:5112
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36C1.bat
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:5636
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:6052
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37BB.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                PID:3884
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:2840
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3886.bat
                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:5920
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:3612
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3980.bat
                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                          PID:3952
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:3376
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A3B.bat
                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:1360
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:5252
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B16.bat
                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                    PID:2516
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:5540
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BD2.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                          PID:4224
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:3116
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C9D.bat
                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:3928
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:2492
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DA6.bat
                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:5984
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:3016
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E62.bat
                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                        PID:2432
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:6040
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F0E.bat
                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:4616
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:4540
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4008.bat
                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                  PID:1008
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:1712
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40C3.bat
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:4896
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:4268
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a418E.bat
                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:5988
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                              PID:3420
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a425A.bat
                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                  PID:4196
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                      PID:4440
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4315.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                          PID:4160
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:1832
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43D1.bat
                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                                PID:3168
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                                    PID:4588
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44AB.bat
                                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:2504
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                                          PID:2984
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4576.bat
                                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                                              PID:4304
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5200
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4632.bat
                                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:1516
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46ED.bat
                                                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:1076
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                                                              PID:356
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47B9.bat
                                                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:3708
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1808
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4884.bat
                                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:264
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:5780
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a495E.bat
                                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:832
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              151⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3796
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A39.bat
                                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:3020
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:5368
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AF5.bat
                                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5644
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:248
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BC0.bat
                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:3700
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D46.bat
                                                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E40.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:908
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a518C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5286.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5342.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a540D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5565.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5620.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5797.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5872.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a594D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A08.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AD3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DA2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FF4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a615B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6226.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6311.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65A1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a664D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6860.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B7D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C38.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DCF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E7A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F36.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FC3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a706E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a712A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7262.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a731E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7428.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7560.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7754.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7800.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a788D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7958.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C17.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CE2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E78.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F14.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FD0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a807C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8128.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8202.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8399.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8435.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a856D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a860A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8696.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8733.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a885B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8965.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A7E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B98.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CE0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EF3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FAE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a905A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9116.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a922F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                352⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  353⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a930A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    354⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        355⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          356⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            357⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9462.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                358⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    359⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      360⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          361⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a959A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            362⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                363⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9627.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    364⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        365⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          366⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              367⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a975F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                368⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    369⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a980B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      370⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        371⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9878.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          372⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            373⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9924.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              374⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  375⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      376⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        377⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A2E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            378⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              379⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ABB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  380⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      381⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        382⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          383⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              384⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  385⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      386⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          387⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CDD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              388⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  389⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA152.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      390⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          391⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              392⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  393⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA27B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      394⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        395⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              397⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA375.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  398⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      399⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          400⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            401⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA45F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              402⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  403⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      404⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          405⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA569.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              406⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  407⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    408⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        409⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6088
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                            • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                            PID:2392
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                              PID:5900
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3212

                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                $$a109B.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a109B.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 47ea5d5b594c818b92c4ff9ccd0a8d56c5142a0dc9bce30269e990e423e25705
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$a13C8.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a13C8.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 b1f70d6b9ac39d1d2a71fce2d9f36e4b5f85a6069eb00997206ebd55aafbca24
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$a17CF.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a17CF.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 c943d8ed0f2ee244acda46567a17307029a4795883ced9ded0b00868df8c00d5
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$a2A1.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a2A1.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 775B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 cf5a62b2d4c59756eb663eb981f9028ad1a8046c14f6ef75f59063f398a91a77
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$a63B.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a63B.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 775B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 6d9d9dd2cbb471691a2fba274413f91e3a608f9f142efd21c832d5b1cb480c5e
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$a987.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a987.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 775B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 791dc75d1cf193928b98a7f22716770b0e54912e71e50a89a91de45bd4e6d98d
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aB2FA.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB2FA.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 d11c13734772c9b4bba1e20c5cc844d6d3a8d68fb0c88f4d2937474cfa911b86
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aB6A4.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB6A4.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 e0cb708d450dabcbf99a6c51ca9d2460aaec900f42cd69154decc6e063bdbd86
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aBB47.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aBB47.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 6a0539066dc423bb8215afaf1b943515d5cb7c578b9a64d6eff91c6ba33db7cb
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aBF2F.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aBF2F.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 5b7563e9bdea8e2f218d7548f53ccbfa6bb91b6a730621d4e1dbe86506ec5a49
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aC27B.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC27B.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 785dd46c93d91ac35b5f23a4d56c1394f506b2f2057b93d2f253e63af5e7ddea
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aC625.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC625.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 594fc60704fdb73612ad2d0b53d0c8610178a9c77595ba493b6366a7f225c8aa
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aCA8A.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aCA8A.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 531de41c6ed650b92e05309d148551dc929a5702959c1b03a69abbee7c2bd450
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aCE2.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aCE2.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 775B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 32f6e1d7e8369c61651e84b5027385e83d7915a91539a970adcd7064d1668d5d
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aD2D7.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD2D7.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 5c2bf229350f978f09f0a3a18249cc50616646cec8779c826eb2570ed9ce1d0a
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aD603.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD603.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 b9fd760c0639cbf4853e5d16eee900ddcc0b465403921a6118fecb0a2be3ac29
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aE90E.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE90E.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 672be8f17a4a539d0354177edfb11508d1d316cee27eb8a0afd10cc5107f227b
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aF12C.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF12C.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ef124ee3b0845ed401c893f68381d57418fd6e65caca3dda9700a6a759960c55
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aF582.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF582.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 b1bef48ce84ff630380a80fa02742ba5254baf9830931182c0d7088b6831d3c2
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                $$aFDEE.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aFDEE.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 f34b81e3d334c1d782be970bcbb2dac397e20c789c6f4f63064725ef9bdfdfe2
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.6MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 151743d00a699c06e6f9d478a11f6f9e9386e8a5f4c9ebd17a31aa8758bf1771
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.6MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 4624005ef01894bdd16b91379db37d11abfed73d3b20af6ebf276b9313740238
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.6MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 4bda4d30d40d967ecc56e3dce6f02b6b8d178cb9bdd6d4986b3a5191b5f118df
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.5MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 aa3a2578285efdf054874fa3f99a2cf07e2d4d96acff135997c6ea639ef5a96c
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.4MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 c8b371dfca8d6f997f53fd63abe5b321f7e6a53a8eb1b6224b436752da08826d
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.3MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 595125de0fd177c05ede354aff0550de9216c5a3f2d766800ed9888c64e51c3c
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.4MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 9c009aa5023fbbcb4e3938a64d2b238c2066bbe488f868a079b0fccafeff01dd
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.3MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3577ad74a2b46ec7430dd58ac5020346471adc4fb394753baa6325e2c322e60b
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.7MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 5e632cd1dc5d10584ffa4e3b0641eae044ac42a0b94a903ef22fbedf6ff38a6e
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.3MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 d486de86a1c74df7dcea9a065e630132c8a0ea785ce856101d645e98221266c2
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.7MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 7fc50cee74bb7c05eda47c33f73abe8da9d667f52528513c32eb604a6ee3ee77
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.9MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ac5cfa60e552b836c0b5b09f319164b6849e25b3bee8fc92c28d873bf6a85ae3
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.8MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ea72c2b2d11fe3256b1ba8a3724bce7104e8aac9dcafa5f05d7a0be73736e44f
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.9MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 fca2ca161b2a35041aa6c6ea3d201d48292d1996aa8c71b029df9378317dcf8b
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.7MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3b8f9d666cfe8bfcb60220a88134c543f4588432739f466772a8a36f82bccf30
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.8MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 9c45ca4c6f487ffa5067d79d5947f87207c14acb54966321c68b567acdcf9ca3
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.8MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 2041c841db77a3783b13f04819946478c6a9f5d33b8f967a764b446f7a8e53d8
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.7MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 877f57aee84e125d8efb1cbbf91585d12c2f0774036b8ee2ebde3b8a90cc7359
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.5MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 15e4e9271a896fcd8ed68fcf0afc10e50a9452af28a6936be6219709495abee1
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.5MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 684af1daa979e56bc2abe7300250fc8ed8e6cc2b590820d2a4baa05058d1d8af
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_4721ea14ea307bc5f888a8992ed7f2d4_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 6.4MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 1464fa186ad837a64c0d4dfa48e3667ea0a3411e10ddb361e5e5935e79162099
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-1738198120-2966725515-3980530802-1000\_desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                • Size 9B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 12e486bcc6f0247b468e0bade91edf555dae9119764975498ef82717d453222f
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                memory/8-8656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/248-8409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/356-8379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/576-5562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/760-8771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/800-8590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/908-8433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/940-8183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/948-8596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/952-8482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1040-8452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1108-8765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1140-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1260-8602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1332-8801-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1420-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1428-5570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1484-8188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1488-7501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1492-8716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1504-8855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1520-8088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1528-8080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1580-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1596-8572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1632-8157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1712-8325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1716-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1780-8421-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1808-8385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1816-8542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1832-8349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1840-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1840-3710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1904-8172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1936-8518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1992-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1996-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2012-8167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2028-8111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2056-8644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2168-8795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2184-8208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-8668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2276-8554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2296-8233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2300-8147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2332-8632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2392-8178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2392-8049-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2392-2035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2392-1471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2392-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2488-8578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2492-8303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2512-8686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2520-6038-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2700-8162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2792-8116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2820-8243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2840-8273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2900-8440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2912-8728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2984-8361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3000-1577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3016-8308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3036-8054-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3100-8512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3116-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3132-8650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3136-8674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3176-8698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3200-8777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3204-8614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3208-8415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3284-8548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3376-8283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3388-8813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3392-8203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3420-8337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3424-8734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3444-8177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3460-8476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3544-8746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3612-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3664-8072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3760-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3760-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3796-8397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3860-8620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3880-8223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3892-8488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3940-8584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3976-8740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4100-8506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4112-8213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4132-8458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4168-8121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4172-8096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4256-8843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4268-8331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4300-8137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4360-8608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4376-8127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4408-8819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4440-8343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4496-8218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4516-8238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4524-8759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4540-8319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4544-8560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4588-8355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4596-8064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4596-8122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4628-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4636-8152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4676-8427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4728-8104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4756-8825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4776-8783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4796-8524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4816-152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4820-8500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4840-8704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4892-8446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4904-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4920-8710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4984-8807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5064-8626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5112-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5132-8638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5200-8367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5236-8662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5240-8566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5252-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5260-8680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5280-8193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5348-8789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5368-8403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5440-8831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5540-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5572-8142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5584-6050-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5608-8464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5676-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5700-8837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5720-8198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5728-8692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5744-8494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5772-8722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5780-8391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5796-8132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5816-8470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5868-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5948-8849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/6004-8753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/6020-8373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/6040-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/6052-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/6068-8228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download