Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 00:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
  • Size 5.7MB
  • Sample260930-a5y7wsvapf
  • SHA256 611b9dfdd6754bff02582a0f66f3ad7eb398f3ea127ad5f4432746dd4c719321
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3780
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5FA.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4916
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA908.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5396
          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:708
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE38.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2696
              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1500
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0C8.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5952
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:6020
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB414.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2188
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:4264
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7BD.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:6132
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1764
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA4D.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4076
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2912
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFAC.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2324
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:1892
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5C7.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5372
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:1952
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFBA.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1120
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:916
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD76B.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3608
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:5028
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEDD.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5020
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5368
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1BB.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1940
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:912
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5A3.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2620
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3616
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE891.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5064
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2072
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB70.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5740
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4928
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF67.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4560
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3564
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF728.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1492
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3228
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9F6.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2924
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:6080
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC87.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3880
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1196
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF46.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2608
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5292
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A7.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:928
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1424
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a291.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:432
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5512
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39B.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5196
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1648
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a457.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4640
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4432
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a512.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4456
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3364
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FC.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5156
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2880
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C8.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3536
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5504
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a793.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2908
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3632
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88D.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4508
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:6048
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a996.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4976
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:52
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA81.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:352
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:4212
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7B.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:6004
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:4960
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC94.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:3136
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4248
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6F.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:4040
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:3636
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3A.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:5412
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:3764
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF15.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:364
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:4956
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD0.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                      PID:1524
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:1692
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10AB.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                            PID:4580
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              79⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:3056
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1195.bat
                                                                                                                                                                                80⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:2556
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  81⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:2776
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1280.bat
                                                                                                                                                                                    82⤵
                                                                                                                                                                                      PID:3272
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        83⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:6000
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a136A.bat
                                                                                                                                                                                          84⤵
                                                                                                                                                                                            PID:1244
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              85⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:1048
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1416.bat
                                                                                                                                                                                                86⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:3644
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:5812
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1500.bat
                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:1984
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:5032
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15CB.bat
                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:840
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:5352
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1687.bat
                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:1924
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:3584
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1752.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                  PID:4268
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:3084
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a185C.bat
                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                        PID:5380
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:1464
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1936.bat
                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:5724
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:1348
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A5F.bat
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:6084
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:4172
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B69.bat
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                      PID:4516
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:5836
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C63.bat
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:3184
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:2356
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D3E.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:820
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:3784
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E28.bat
                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                    PID:2492
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3528
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EF3.bat
                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2316
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:688
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FDD.bat
                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                              PID:5000
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:5400
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2099.bat
                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                    PID:3208
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:4844
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2174.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                          PID:5044
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:2376
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a224E.bat
                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:3452
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:1332
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2329.bat
                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                    PID:2520
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:5744
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23F4.bat
                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:1504
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:5456
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24B0.bat
                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                              PID:3812
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:5640
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a255C.bat
                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:4952
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    PID:2336
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2665.bat
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                        PID:2352
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:5472
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2702.bat
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:5508
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                PID:4316
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27AD.bat
                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:4108
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                      PID:416
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2859.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:5324
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                            PID:1876
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2905.bat
                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:2368
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:2528
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29C1.bat
                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                    PID:6140
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:2972
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A7C.bat
                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:1328
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:5664
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B28.bat
                                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                                              PID:5764
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:5308
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BF3.bat
                                                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:1632
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    PID:792
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C9F.bat
                                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:3108
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6036
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D5B.bat
                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:2392
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:8
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E16.bat
                                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1780
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1528
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EE1.bat
                                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5104
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:4228
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FCC.bat
                                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4792
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2080
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3087.bat
                                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5492
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:464
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3123.bat
                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5872
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2296
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32AA.bat
                                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3346.bat
                                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3411.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a350B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3692.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a374D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3951.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AC8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C2F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E52.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F8B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4056.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a418E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a421B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4363.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a440F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4596.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4642.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4874.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4920.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49AD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A58.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AE5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B91.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C2D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CD9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D66.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E8F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F2B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FC7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5073.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5100.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a519C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5228.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5371.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a540D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5499.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5545.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a567E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a570A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5787.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5824.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a595C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A08.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BDD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C89.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D44.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DC1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EDA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6003.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a612C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6226.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62A3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a635F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6488.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6514.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6582.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a660E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a668B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6708.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6795.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6812.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5268
                                                                                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Creates a file in the Startup directory
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                            PID:2524
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                              PID:2436
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:6048

                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                                                                Windows Command Shell

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1059.003

                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                Credentials from Password Stores

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1555

                                                                                                                                                                                                                                                                Credentials from Web Browsers

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1555.003

                                                                                                                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1552

                                                                                                                                                                                                                                                                Credentials In Files

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1552.001

                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                System Location Discovery

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1614

                                                                                                                                                                                                                                                                System Language Discovery

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1614.001

                                                                                                                                                                                                                                                                System Network Configuration Discovery

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1016

                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                T1005

                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                $$aA5FA.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA5FA.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 80cb29a4b623492f2b965913ce690ad016c301ecd1042afa5aa19dad62be963f
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aA908.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA908.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 3179b5d18e92c7f0cc2f4a46818c50425db7fbeb504a7b31151ddacd261297f5
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aAE38.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aAE38.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 4bde5bace15d55cfdc267483bf300656c021bf133953b4553dfb210dfaccdaf6
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aB0C8.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB0C8.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 ed533af52ed0eec521cd03a417b66eec67e91aec01b5b67f2ca32ff5b5078adc
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aB414.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB414.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 756ebfbff58ef98eae9405d7020bbc8391affcffbf4a22c079234f30190e2efe
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aB7BD.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB7BD.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 899f2ae9184e80f645732343c909cd754bac1b0431e5e44bbfa299ab2638d78d
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aBA4D.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aBA4D.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 743921e575eeb1fd078d72051f47d0ad9a1dd85dbb8683bdcfdf51447873bf55
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aBFAC.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aBFAC.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 6d0843233e888ee2f663a1021ec2f03d3a40bc7928f992e2d88e302cbacb49bc
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aC5C7.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC5C7.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 7a8c7e13fd079ed1f6dbff5a58839136070bf51e535418ecbd001d9553491454
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aCFBA.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aCFBA.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 68e2d4c898a3f2337496c9ca2a358226d7dc2d54537ae06949df05ba018141fd
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aD76B.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD76B.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 456228753413709d1469b48915062e740821826101fbb0401939b7f49c944717
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aDEDD.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aDEDD.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 679c5940ca1222c0ffd37458928826974270f10b0d511419c8f63f7c80be5e3d
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aE1BB.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE1BB.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 8fe47ea12d6a296a8ee5c85d04cf3c58ecd13c70f9371e9b58b9feacbabdfe11
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aE5A3.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE5A3.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 e5e465b1d1e6004a55e002fb1a907c11a16217edfee618b3f2e900bdc3724b38
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aE891.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE891.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 a1c42c4990d1e6d97d49af0e8cd553564e45c7dfb79abfeea585463f247a7f40
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aEB70.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aEB70.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 813e43e5bee6664256803db214377df882a5c471601012d140153df0b49ff9aa
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aEF67.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aEF67.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 9e53a7a901f2e14bd49cca7748b539aec56cf6fed9c104446dde6c8b054ca674
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aF728.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF728.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 df5f7e036994692e0d73f82c068fdd4c1fe42d979b4810fe07b5dbd06589c1b2
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aF9F6.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF9F6.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 30cdf06b6b9ea18548e29c56cff3704239831bd8effdab229427366fbfc95686
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aFC87.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aFC87.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 91d082d917129be8ca8129ce2a4a9630b2d61ed315572093c20464e9f837118e
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                $$aFF46.bat
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aFF46.bat
                                                                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                                                                • SHA256 f3e198a27297d9c15f9bd45766a96336e29ba45f608db376d6b3e1c26d8d21fc
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                • SHA256 f86b78b68b27b84143c1601605ba13426cbff2dd424e5051b8eddfab03213469
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                • SHA256 d99ed0b07e807fd6bae9e5e3b8955d432fa247d3ce64e8d39f277b4efad15307
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                                                                • SHA256 9035482c3693e4e3391c9540575d91d541c0f2a88f477f0f877f2e7ab121be6f
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                                                                • SHA256 5abdc9e8aed2b91f3abc27f8bf8b47f3b7be377a5bdd4a7debb252736506dad9
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                • SHA256 c4a271a9b1b1df97c5b22bd1d59fa043c4e8318e280fe2f6cfe9837bec023c92
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                • SHA256 0660a9fde2c605fd3565c8205f4dac9bcb270edc6e131f284166907e22911735
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                                                                • SHA256 a1734c33aad9359bfd6093da855abe3e9f327e6ae8c7a40370947c8801a59fa0
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                                                                • SHA256 a5cd9c9851128c842bf865cdcc4cfda6a489f483b69ba425ce579f64ce4347dd
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                                                                • SHA256 2548a0dc69b1a0008fd5a9ad7f66ba4a9913ebc4594db4253c7c33aaabd858b9
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                • SHA256 88ca96a5b63dfd85fd43fa459c9ec3231f0f4be9c8f42f7da99358a02935f334
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                                                                • SHA256 ed198391c50d9fc00099a3d78dc8f3cd6639d739b3941afbd1ac4759090ffa6c
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                • SHA256 d06f654e9e282c3784a1237d35572be4b2766145b159bdd23b9d949a176c869a
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                • SHA256 b7a9c5ee56fc26015319ebaff86f7bb9a80dbd8bd7daee18c5ff76f12d9021a6
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                • SHA256 1fbe7f208d96a55a5160b97526aff29e68399654a35d3d9f57b8d856bc2d0544
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                • SHA256 f1883acc2760a89a0cb446d486b8b4319847502c0ce9f4d07b46e7ba99eef695
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                • SHA256 6c3adedfb68f2d52e168a6c3bb623c8993394bd3708d9fc40ca81bfb9ba80137
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                • SHA256 b86779e7e172ad4c7e3f8dc7e44d2e63c3a4c80faaa8984efdf0d7d23b041cc4
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                • SHA256 70eff9dae516aef75652d1d88c7250e40735562017b81b6e6546338680d8d3b0
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                • SHA256 9263044b8922b078cc329f4513fe86c16b0ec4022d1589f0d305c2c08b7472f7
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_5579773a7a0afa0f21c8aa35ecfcc9c1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                • SHA256 b39fbebfbf476bf2f935a4c338159c792d737a959b47a427171d758c72cb22a2
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-4154726816-2055034831-2297277433-1000\_desktop.ini
                                                                                                                                                                                                                                                                • Size 9B
                                                                                                                                                                                                                                                                • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                memory/8-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/52-8267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/260-8665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/416-8449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/464-8521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/520-8846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/688-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/700-8629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/708-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/792-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/852-8696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/912-6055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/916-4471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/972-8912-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1036-8942-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1048-8322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1068-8918-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1196-8211-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1332-8409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1348-8357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1424-8222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1456-8672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1464-8352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1500-3461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1500-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1528-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1588-8623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1648-8232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1680-8948-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1692-8302-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1764-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1868-8708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1876-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1892-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/1952-2894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2072-6075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2080-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2084-8617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2296-8533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2336-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2356-8374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2376-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2448-8732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2524-7779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2524-2524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2524-1844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2524-8363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2524-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2528-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2580-8858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2716-8822-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2732-8726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2768-8924-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2776-8312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2788-8605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2804-8816-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2880-8247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2912-418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2960-8792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/2972-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3004-8888-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3056-8307-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3060-8936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3084-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3152-8593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3192-8840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3216-8635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3228-8193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3240-8575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3364-8242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3388-8768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3444-8714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3528-8384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3564-7948-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3584-8342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3616-6063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3624-8834-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3632-8257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3636-8287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3728-8780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3764-8292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3780-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3780-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3784-8379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3800-8738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3816-8906-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3848-8864-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/3872-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4036-8557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4068-8756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4136-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4156-8882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4172-8362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4212-8272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4228-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4248-8282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4264-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4316-8443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4352-8545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4400-8720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4428-8690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4432-8237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4436-8930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4484-8804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4604-8750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4628-8527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4688-8659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4692-8960-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4700-8641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4768-8744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4820-8762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4844-8399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4916-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4928-6286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4932-8798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4956-8297-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4960-8277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/4980-8702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5028-5578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5032-8332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5092-8539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5276-8678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5284-8611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5288-8684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5292-8217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5296-8647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5300-8774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5308-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5320-8876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5352-8337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5368-5586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5400-8394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5444-8653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5456-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5472-8437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5496-8581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5504-8252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5512-8227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5532-8587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5564-8810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5600-8828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5636-8786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5640-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5664-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5684-8954-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5688-8870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5744-8414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5812-8327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5836-8369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5836-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5948-8852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5984-8894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/5996-8900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/6000-8317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/6020-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/6036-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/6048-8262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/6080-8201-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/6112-8599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                memory/6128-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                Download